CVE-2023-35942
Summary
| CVE | CVE-2023-35942 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-07-25 19:15:00 UTC |
|---|
| Updated | 2023-08-02 18:36:00 UTC |
|---|
| Description | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, disable gRPC access log or stop listener update. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Envoyproxy |
Envoy |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| gRPC access log crash caused by the listener draining · Advisory · envoyproxy/envoy · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 355870 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2023-2023-300
- 356117 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2023-2023-344
- 356246 Amazon Linux Security Advisory for ecs-service-connect-agent : ALASECS-2023-007
- 356504 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2ECS-2023-007
