CVE-2024-45809: Jwt filter crash in the clear route cache with remote JWKs in envoy
First published: Thu Sep 19 2024(Updated: )
Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT header operations modify requests to not match any route. When these conditions are met, a crash is triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2, 1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoy Proxy | >=1.29.0<1.29.9 | |
| Envoy Proxy | >=1.30.0<1.30.6 | |
| Envoy Proxy | >=1.31.0<1.31.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-45809?
CVE-2024-45809 has a high severity as it can lead to a crash of the Envoy service.
How do I fix CVE-2024-45809?
To fix CVE-2024-45809, you should upgrade Envoy to versions 1.29.9, 1.30.6, or 1.31.2 or later.
What are the affected versions for CVE-2024-45809?
CVE-2024-45809 affects Envoy versions from 1.29.0 to 1.29.9, 1.30.0 to 1.30.6, and 1.31.0 to 1.31.2.
What conditions lead to the crash in CVE-2024-45809?
The crash occurs when remote JWKs are used with clear_route_cache enabled while requiring async header processing.
Is there a workaround for CVE-2024-45809?
A temporary workaround for CVE-2024-45809 is to disable the clear_route_cache feature if using remote JWKs.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/envoyproxy
- canonical/envoy proxy
- version/envoy proxy/1.29.0
- version/envoy proxy/1.30.0
- version/envoy proxy/1.31.0