Beveiligingsadvies

CVE-2024-23324

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2024-02-09 22:48:26

Laatst bijgewerkt 2024-08-19 16:12:49

Toegewezen door GitHub_M

CVSS-score 8.6

Status PUBLISHED

Beschrijving

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

← Alle CVE's bekijken Bekijk op cve.org ↗