CVE-2024-53269 Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy
Attackers can crash the Envoy proxy data plane by providing non-IP addresses in Happy Eyeballs sorting, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53269?
CVE-2024-53269 is a medium-severity vulnerability in Envoyproxy Envoy, published on 18 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users are advised to upgrade. Users unable to upgrade may disable Happy Eyeballs and/or change the IP configuration.
Weakness: CWE-670
Which versions are affected by CVE-2024-53269?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | From 1.30.0 | 1.30.8, 1.31.4, 1.32.2 |
Products include Envoyproxy Envoy.
How do I fix CVE-2024-53269?
Upgrade envoy to a fixed version for your release line: 1.30.8, 1.31.4 or 1.32.2.
Is CVE-2024-53269 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53269 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2024-53269, GHSA-mfqp-7mmj-rm53.