Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-45806 #3145

Closed
GoVulnBot opened this issue Sep 20, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-45806 #3145

GoVulnBot opened this issue Sep 20, 2024 · 1 comment
Assignees
@zpavlinovic
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged

Comments

@GoVulnBot
Copy link

Advisory CVE-2024-45806 references a vulnerability in the following Go modules:

Module
github.com/envoyproxy/envoy

Description:
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically considered internal, even if the internal_address_config was empty. The defa...

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      vulnerable_at: 1.31.2
summary: CVE-2024-45806 in github.com/envoyproxy/envoy
cves:
    - CVE-2024-45806
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45806
    - web: https://github.com/envoyproxy/envoy/security/advisories/GHSA-ffhv-fvxq-r6mf
source:
    id: CVE-2024-45806
    created: 2024-09-20T01:01:20.210032458Z
review_status: UNREVIEWED
@zpavlinovic zpavlinovic added possibly not Go triaged excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. labels Sep 20, 2024
@zpavlinovic zpavlinovic self-assigned this Sep 20, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/614715 mentions this issue: data/excluded: add 6 reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zpavlinovic zpavlinovic

Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zpavlinovic @gopherbot @GoVulnBot