CVE-2024-45808: Malicious log injection via access logs in envoy
Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTEDSERVERNAME field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45808?
CVE-2024-45808 has been classified with medium severity due to the potential for log content injection.
How do I fix CVE-2024-45808?
To mitigate CVE-2024-45808, upgrade Envoy to versions later than 1.28.7, 1.29.9, 1.30.6, or 1.31.2.
What versions of Envoy are affected by CVE-2024-45808?
CVE-2024-45808 affects Envoy versions prior to 1.28.8, between 1.29.0 and 1.29.9, 1.30.0 to 1.30.6, and 1.31.0 to 1.31.2.
What attack vector is used in CVE-2024-45808?
CVE-2024-45808 allows attackers to exploit the lack of validation in the REQUESTED_SERVER_NAME field to inject content into access logs.
Who is responsible for the Envoy Proxy vulnerability CVE-2024-45808?
The Envoy Proxy project team is responsible for addressing CVE-2024-45808, which affects their open-source proxy software.