Bug 2276149 (CVE-2024-32475)

Summary:	CVE-2024-32475 envoy: abnormal termination when using auto_sni with authority header longer than 255 characters
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	jwendell, rcernich, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	envoy 1.30.1, envoy 1.29.4, envoy 1.28.3, envoy 1.27.5	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Envoy, a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with "auto_sni" enabled, a request containing a "host/:authority" header longer than 255 characters triggers an abnormal termination of the Envoy process, leading to a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2276148

Description Robb Gatica 2024-04-19 20:31:27 UTC

Summary:
When an upstream TLS cluster is used with auto_sni enabled, a request containing a host/:authority (or alternate header configured via override_auto_sni_header ) header longer than 255 characters triggers an abnormal termination of Envoy process.

Affected Components:
TLS component for outbound connections.

Details:
Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the host/:authority header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails.

Impact:
Denial of Service due to abnormal process termination.

Attack vector(s):
A client request with host/:authority header (or alternate header configured via override_auto_sni_header ) longer than 255 characters that is proxied to Envoy cluster with auto_sni option set to true.

Patches:
This bug affects all currently maintained versions (and all versions from 1.13 to 1.30): 1.27.x, 1.28.x, 1.29.x, 1.30.x.

This bug is fixed in our latest versions. Update to the following versions to resolve:
>=1.30.1
>=1.29.4
>=1.28.3
>=1.27.5

References:
https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj

Comment 2 Robb Gatica 2024-04-19 20:43:05 UTC

Affects determined by recent Envoy tasks/flaws (e.g., 2259231)

Comment 4 errata-xmlrpc 2024-10-07 09:22:40 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.4 for RHEL 8

Via RHSA-2024:7724 https://access.redhat.com/errata/RHSA-2024:7724

Comment 5 errata-xmlrpc 2024-10-07 09:25:48 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.5 for RHEL 8

Via RHSA-2024:7725 https://access.redhat.com/errata/RHSA-2024:7725