QID 357322

envoy is a high-performance edge/middle/service proxy.
Envoy will crash when certain timeouts happen within the same interval.
The crash occurs when the following are true: 1.
Hedge_on_per_try_timeout is enabled, 2.
Per_try_idle_timeout is enabled (it can only be done in configuration), 3.
Per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout.
This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7.
Users are advised to upgrade.
There are no known workarounds for this vulnerability. (
( CVE-2024-23322) envoy is a high-performance edge/middle/service proxy.
The regex expression is compiled for every request and can result in high cpu usage and increased request latency when multiple routes are configured with such matchers.
( CVE-2024-23323) envoy is a high-performance edge/middle/service proxy.
External authentication can be bypassed by downstream connections.
Downstream clients can force invalid grpc requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true.
( CVE-2024-23324) envoy is a high-performance edge/middle/service proxy.
Envoy crashes in proxy protocol when using an address type that isnt supported by the os.
Envoy is susceptible to crashing on a host with ipv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its ipv6 address.
it is valid for a client to present its ipv6 address to a target server even though the whole chain is connected via ipv4.
( CVE-2024-23325) envoy is a high-performance edge/middle/service proxy.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.