Bug 925030 (CVE-2024-23322, CVE-2024-23323, CVE-2024-23324, CVE-2024-23325, CVE-2024-23327) – <app-admin/consul-1.15.10: multiple vulnerabilities in bundled envoy

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2024-02-20 01:43:08 UTC]

CVE-2024-23322 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38):

Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is enabled, either through headers or configuration and its value is equal, or within the backoff interval of the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2024-23323 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch):

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2024-23324 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6):

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz, circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CVE-2024-23325 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-5m7c-mrwr-pm26):

Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address.  It is valid for a client to present its IPv6 address to a target server even though the whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE-2024-23327 (https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j):

Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Please bump to 1.15.10.

[Comment 1 Larry the Git Cow 2024-02-20 02:10:43 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2d45112be97327c674fc218c527a9522b7f71c39

commit 2d45112be97327c674fc218c527a9522b7f71c39
Author:     Zac Medico <[e-mail]>
AuthorDate: 2024-02-20 02:08:07 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2024-02-20 02:08:22 +0000

    app-admin/consul: add 1.15.10
    
    Bug: https://bugs.gentoo.org/925030
    Signed-off-by: Zac Medico <[e-mail]>

 app-admin/consul/Manifest              |  1 +
 app-admin/consul/consul-1.15.10.ebuild | 61 ++++++++++++++++++++++++++++++++++
 2 files changed, 62 insertions(+)

[Comment 2 John Helmert III 2024-02-20 05:54:02 UTC]

Thanks! Please stable when ready

[Comment 3 John Helmert III 2024-09-22 03:05:13 UTC]

Zac/Ultrabug, can we cleanup?

[Comment 4 Larry the Git Cow 2024-12-08 08:38:59 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=8e9782e9da489c617d2f765d94af1f83cb851840

commit 8e9782e9da489c617d2f765d94af1f83cb851840
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-12-08 08:38:34 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-12-08 08:38:57 +0000

    [ GLSA 202412-14 ] HashiCorp Consul: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/907925
    Bug: https://bugs.gentoo.org/917614
    Bug: https://bugs.gentoo.org/925030
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202412-14.xml | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

[Comment 5 Larry the Git Cow 2024-12-08 18:53:45 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=ce8fb261699318ec06c033f2b06946952d803953

commit ce8fb261699318ec06c033f2b06946952d803953
Author:     Zac Medico <[e-mail]>
AuthorDate: 2024-12-08 18:51:52 +0000
Commit:     Zac Medico <[e-mail]>
CommitDate: 2024-12-08 18:53:27 +0000

    app-admin/consul: drop 1.15.3, 1.15.11
    
    Bug: https://bugs.gentoo.org/925030
    Signed-off-by: Zac Medico <[e-mail]>

 app-admin/consul/Manifest              |  3 --
 app-admin/consul/consul-1.15.11.ebuild | 62 ----------------------------------
 app-admin/consul/consul-1.15.3.ebuild  | 61 ---------------------------------
 3 files changed, 126 deletions(-)