CVE-2024-32475: Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes
Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the host/:authority header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails. This vulnerability is fixed in 1.30.1, 1.29.4, 1.28.3, and 1.27.5.
Other sources
Summary: When an upstream TLS cluster is used with autosni enabled, a request containing a host/:authority (or alternate header configured via overrideautosniheader ) header longer than 255 characters triggers an abnormal termination of Envoy process.
Affected Components: TLS component for outbound connections.
Details: Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the host/:authority header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails.
Impact: Denial of Service due to abnormal process termination.
Attack vector(s): A client request with host/:authority header (or alternate header configured via overrideautosniheader ) longer than 255 characters that is proxied to Envoy cluster with autosni option set to true.
Patches: This bug affects all currently maintained versions (and all versions from 1.13 to 1.30): 1.27.x, 1.28.x, 1.29.x, 1.30.x.
This bug is fixed in our latest versions. Update to the following versions to resolve: =1.30.1 =1.29.4 =1.28.3 =1.27.5
References: https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382 https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.30.1 - Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.29.4 - Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.28.3 - Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.27.5 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.30.1 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.29.4 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.28.3 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.27.5
Event History
Frequently Asked Questions
What is the severity of CVE-2024-32475?
CVE-2024-32475 is considered to have a high severity due to the potential for denial of service through abnormal termination of the Envoy process.
How do I fix CVE-2024-32475?
To fix CVE-2024-32475, you should upgrade Envoy to version 1.30.1, 1.29.4, or 1.27.5 from Red Hat.
What triggers the vulnerability in CVE-2024-32475?
CVE-2024-32475 is triggered by a request containing a host or :authority header longer than 255 characters when using an upstream TLS cluster with auto_sni enabled.
Who is affected by CVE-2024-32475?
Users of Envoy versions prior to 1.30.1, 1.29.4, and 1.27.5 are affected by CVE-2024-32475 due to the abnormal termination risk.
What software does CVE-2024-32475 impact?
CVE-2024-32475 impacts the Envoy proxy software when configured with specific TLS settings.