Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT header operations modify requests to not match any route. When these conditions are met, a crash is triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2, 1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-758 advisory.

    Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy     allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other     malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal     trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for     handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically     considered internal, even if the internal_address_config was empty.  The default configuration of Envoy     will continue to trust internal addresses while in this release and it will not trust them by default in     next release. If you have tooling such as probes on your private network which need to be treated as     trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges     into `internal_address_config`. Successful exploitation could allow attackers to bypass security controls,     access sensitive data, or disrupt services within the mesh, like Istio. This issue has been addressed in     versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds     for this vulnerability. (CVE-2024-45806)

    Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in     Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by     exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has     been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2024-45808)

    Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash     when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires     async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled     in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT     header operations modify requests to not match any route. When these conditions are met, a crash is     triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the     ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2,     1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2024-45809)

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async     client is handling `sendLocalReply` under some circumstance, e.g., websocket upgrade, and requests     mirroring. The http async client will crash during the `sendLocalReply()` in http async client, one reason     is http async client is duplicating the status code, another one is the destroy of router is called at the     destructor of the async stream, while the stream is deferred deleted at first. There will be problems that     the stream decoder is destroyed but its reference is called in `router.onDestroy()`, causing segment     fault. This will impact ext_authz if the `upgrade` and `connection` header are allowed, and request     mirrorring. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-45810)

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing anASN.1 Generalized Time     field. If given an syntactically incorrect field, theparser might end up using -1 for the length of the
    *time fraction*, leading toa `strlen()` getting performed on a pointer to a heap buffer area that is     not(purposely) null terminated.

    This flaw most likely leads to a crash, but can also lead to heap contentsgetting returned to the     application when[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
    (CVE-2024-7264)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.9.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-045 advisory.

    Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy     allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other     malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal     trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for     handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically     considered internal, even if the internal_address_config was empty.  The default configuration of Envoy     will continue to trust internal addresses while in this release and it will not trust them by default in     next release. If you have tooling such as probes on your private network which need to be treated as     trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges     into `internal_address_config`. Successful exploitation could allow attackers to bypass security controls,     access sensitive data, or disrupt services within the mesh, like Istio. This issue has been addressed in     versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds     for this vulnerability. (CVE-2024-45806)

    Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in     Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by     exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has     been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2024-45808)

    Envoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash     when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires     async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled     in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT     header operations modify requests to not match any route. When these conditions are met, a crash is     triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the     ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2,     1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
    (CVE-2024-45809)

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async     client is handling `sendLocalReply` under some circumstance, e.g., websocket upgrade, and requests     mirroring. The http async client will crash during the `sendLocalReply()` in http async client, one reason     is http async client is duplicating the status code, another one is the destroy of router is called at the     destructor of the async stream, while the stream is deferred deleted at first. There will be problems that     the stream decoder is destroyed but its reference is called in `router.onDestroy()`, causing segment     fault. This will impact ext_authz if the `upgrade` and `connection` header are allowed, and request     mirrorring. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are     advised to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-45810)

    libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing anASN.1 Generalized Time     field. If given an syntactically incorrect field, theparser might end up using -1 for the length of the
    *time fraction*, leading toa `strlen()` getting performed on a pointer to a heap buffer area that is     not(purposely) null terminated.

    This flaw most likely leads to a crash, but can also lead to heap contentsgetting returned to the     application when[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
    (CVE-2024-7264)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211373	Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-758)	Nessus	Amazon Linux Local Security Checks	medium
210925	Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-045)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2024-45809

high

Tenable Plugins

medium

medium