CVE-2023-41378 Calico Typha hangs during unclean TLS handshake
An attacker can cause a denial of service in Calico Typha by initiating an unclean TLS handshake that blocks the server's main loop indefinitely.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-41378?
CVE-2023-41378 is a high-severity denial of service vulnerability in Calico Typha, published on 6 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.
Which versions are affected by CVE-2023-41378?
4 open source packages ship an affected version, including github.com/projectcalico/calico. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectcalico/calico Go | All versions to 3.25.1 | None |
github.com/projectcalico/calico Go | All versions to 3.25.1 | None |
github.com/projectcalico/calico Go | From 3.26.0 | 3.26.3 |
github.com/projectcalico/calico Go | From 3.26.0 | 3.26.3 |
Products include Tigera Calico Cloud, Tigera Calico Enterprise, Tigera Calico Os.
How do I fix CVE-2023-41378?
Upgrade github.com/projectcalico/calico to 3.26.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-41378 being exploited?
There is no known exploitation of CVE-2023-41378 in the wild and no public exploit code.
Sources
Also known as GHSA-5r5h-q934-cccp.