Skip to main content

Always-Incorrect Control Flow Implementation

CVE-2024-45807

High
7.5/10

Summary

Envoy is a cloud-native high-performance edge/middle/service proxy. In github.com/envoyproxy/envoy package versions 1.29.0 through 1.29.1, and 1.31.0 through 1.31.1, it uses "oghttp" as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this, Envoy will switch off "oghttp2" by default. The impact of this issue is that envoy will crash. This issue has been addressed in versions 1.29.2, and 1.31.2. All users are advised to upgrade. There are no known workarounds for this issue.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-670 - Always-Incorrect Control Flow Implementation

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

References

Advisory Timeline

  • Published