REDHAT-BUG-2313687: Medium severity envoy proxy vulnerability
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling sendLocalReply under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the sendLocalReply() in http async client, one reason is http async client is duplicating the status code, another one is the destroy of router is called at the destructor of the async stream, while the stream is deferred deleted at first. There will be problems that the stream decoder is destroyed but its reference is called in router.onDestroy(), causing segment fault. This will impact extauthz if the upgrade and connection header are allowed, and request mirrorring. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2313687?
The severity of REDHAT-BUG-2313687 can vary based on the specific deployment and usage scenarios of Envoy Proxy.
How do I fix REDHAT-BUG-2313687?
To fix REDHAT-BUG-2313687, you should upgrade Envoy Proxy to version 1.28.7 or later to avoid the crashing issue.
What are the affected versions for REDHAT-BUG-2313687?
REDHAT-BUG-2313687 affects Envoy Proxy versions prior to 1.28.7.
What causes the crash in REDHAT-BUG-2313687?
The crash in REDHAT-BUG-2313687 is caused when the HTTP async client handles `sendLocalReply` under specific circumstances like websocket upgrades.
Is there a workaround for REDHAT-BUG-2313687?
Currently, there are no documented workarounds for REDHAT-BUG-2313687; updating to a fixed version is recommended.