Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header. This occurs when the downstream request has a command type of LOCAL and does not have the protocol block. This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12347 advisory.

    - Address CVE-2024-24786

    cri-tools
    - Address CVE-2024-24786

    etcd
    - Address protobuf [CVE-2024-24786]
    - Address protobuf [CVE-2024-24786]
    - Backport from 1.19.7 to address CVE-2024-23322, CVE-2024-23323, CVE-2024-23324, CVE-2024-23325,     CVE-2024-23327

    kubernetes
    - Update Istio-1.17.8 to address CVE-2024-24786, CVE-2024-23322, CVE-2024-23323, CVE-2024-23324,     CVE-2024-23325, CVE-2024-23327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12348 advisory.

    - Address CVE-2024-24786

    cri-tools
    - Address CVE-2024-24786

    etcd
    - Address protobuf [CVE-2024-24786]
    - Address protobuf [CVE-2024-24786]
    - Backport from 1.19.7 to address CVE-2024-23322, CVE-2024-23323, CVE-2024-23324, CVE-2024-23325,     CVE-2024-23327

    kubernetes
    - Update Istio-1.17.8 to address CVE-2024-24786, CVE-2024-23322, CVE-2024-23323, CVE-2024-23324,     CVE-2024-23325, CVE-2024-23327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12329 advisory.

    - Address CVE-2024-24786

    cri-tools
    - Address CVE-2024-24786

    etcd
    - Address protobuf [CVE-2024-24786]
    - Address CVE-2023-39326 by upgrading golang to version 1.20.12

    istio
    - Address protobuf [CVE-2024-24786]
    - Backport from 1.19.7 to address CVE-2024-23322, CVE-2024-23323, CVE-2024-23324, CVE-2024-23325,     CVE-2024-23327

    kubernetes
    - Update Istio-1.16.7 to address CVE-2024-24786, CVE-2024-23322, CVE-2024-23323, CVE-2024-23324,     CVE-2024-23325, CVE-2024-23327

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12328 advisory.

    - Address CVE-2024-24786

    cri-tools
    - Address CVE-2024-24786

    etcd
    - Address protobuf [CVE-2024-24786]
    - Address CVE-2023-39326 by upgrading golang to version 1.20.12

    istio
    - Address protobuf [CVE-2024-24786]
    - Backport from 1.19.7 to address CVE-2024-23322, CVE-2024-23323, CVE-2024-23324, CVE-2024-23325,     CVE-2024-23327

    kubernetes

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-service-connect-agent installed on the remote host is prior to v1.27.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-034 advisory.

  - Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen     within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is     enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is     enabled, either through headers or configuration and its value is equal, or within the backoff interval of     the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7.
    Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23322)

  - Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request     and can result in high CPU usage and increased request latency when multiple routes are configured with     such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23323)

  - Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by     downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz,     circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in     released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds     for this vulnerability. (CVE-2024-23324)

  - Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an     address type that isn't supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled     and a listener config with proxy protocol enabled when it receives a request where the client presents its     IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the     whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and     1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2024-23325)

  - Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and     subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header.
    This occurs when the downstream request has a command type of LOCAL and does not have the protocol block.
    This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23327)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-543 advisory.

  - Envoy is a high-performance edge/middle/service proxy. Envoy will crash when certain timeouts happen     within the same interval. The crash occurs when the following are true: 1. hedge_on_per_try_timeout is     enabled, 2. per_try_idle_timeout is enabled (it can only be done in configuration), 3. per-try-timeout is     enabled, either through headers or configuration and its value is equal, or within the backoff interval of     the per_try_idle_timeout. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7.
    Users are advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23322)

  - Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request     and can result in high CPU usage and increased request latency when multiple routes are configured with     such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23323)

  - Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by     downstream connections. Downstream clients can force invalid gRPC requests to be sent to ext_authz,     circumventing ext_authz checks when failure_mode_allow is set to true. This issue has been addressed in     released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds     for this vulnerability. (CVE-2024-23324)

  - Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an     address type that isn't supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled     and a listener config with proxy protocol enabled when it receives a request where the client presents its     IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the     whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and     1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2024-23325)

  - Envoy is a high-performance edge/middle/service proxy. When PPv2 is enabled both on a listener and     subsequent cluster, the Envoy instance will segfault when attempting to craft the upstream PPv2 header.
    This occurs when the downstream request has a command type of LOCAL and does not have the protocol block.
    This issue has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to     upgrade. There are no known workarounds for this vulnerability. (CVE-2024-23327)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194451	Oracle Linux 9 : cri-o (ELSA-2024-12347)	Nessus	Oracle Linux Local Security Checks	high
194450	Oracle Linux 8 : cri-o (ELSA-2024-12348)	Nessus	Oracle Linux Local Security Checks	high
193411	Oracle Linux 7 : cri-o (ELSA-2024-12329)	Nessus	Oracle Linux Local Security Checks	high
193403	Oracle Linux 8 : cri-o (ELSA-2024-12328)	Nessus	Oracle Linux Local Security Checks	high
191659	Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-034)	Nessus	Amazon Linux Local Security Checks	high
191589	Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-543)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2024-23327

high

Tenable Plugins

high

high

high

high

high

high