Groups
Conversations
All groups and messages
Send feedback to Google
Help
Training
Sign in
Groups
envoy-announce
Conversations
About
Groups keyboard shortcuts have been updated
Dismiss
See shortcuts
Envoy security releases [1.32.3, 1.31.5, 1.30.9, 1.29.12] are available today
24 views
Skip to first unread message
Boteng Yao
unread,
Dec 18, 2024, 1:05:20 PM
12/18/24
Reply to author
Sign in to reply to author
Forward
Sign in to forward
Delete
You do not have permission to delete messages in this group
Copy link
Report message
Show original message
Either email addresses are anonymous for this group or you need the view member email addresses permission to view the original message
to envoy-secur...@googlegroups.com, envoy-security, envoy-ma...@googlegroups.com, envoy-a...@googlegroups.com, envoy...@googlegroups.com, envo...@googlegroups.com
Hi Envoy Community,
We would like to disclose the following CVEs:
[CVE-2024-53269](
https://github.com/envoyproxy/envoy/security/advisories/GHSA-mfqp-7mmj-rm53
): - Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting.
Affected branches: >= 1.30
[CVE-2024-53270](
https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3
): HTTP/1: sending overload crashes when the request is reset beforehand.
Affected branches: all listed below
[CVE-2024-53271] (
https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4f
): HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset.
Affected branches: >= 1.31
These issues will be resolved in the following releases:
- v1.32.3
- v1.31.5
- v1.30.9
- v1.29.12
The releases will be published to our releases page as they become available today:
https://github.com/envoyproxy/envoy/releases
You are encouraged to update your versions of Envoy, and documentation for all versions can be found at
https://www.envoyproxy.io/docs
.
A PR to resolve these issues on the `main` branch has been raised here:
https://github.com/envoyproxy/envoy/pull/37743
Thanks,
Ryan Northey (@phlax)
Boteng Yao (@botengyao)
Reply all
Reply to author
Forward
0 new messages