中危 Envoy 资源管理错误漏洞(CVE-2023-35945)
CVE编号
CVE-2023-35945利用情况
暂无补丁情况
官方补丁披露时间
2023-07-14漏洞描述
Envoy是一款开源的分布式代理服务器。Envoy 1.27.0之前版本存在资源管理错误漏洞，该漏洞源于Envoy 的 HTTP/2 编解码器在收到来自上游服务器的帧RST_STREAM后，可能会泄漏header map和bookkeeping structures。解决建议
"将组件 envoyproxy/envoy 升级至 1.21.11 及以上版本""将组件 envoyproxy/envoy 升级至 1.26.3 及以上版本""将组件 envoyproxy/envoy 升级至 1.24.9 及以上版本""将组件 envoyproxy/envoy 升级至 1.25.8 及以上版本"
参考链接 |
|
|---|---|
| https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r | |
| https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb75... |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | envoyproxy | envoy | * | Up to (excluding) 1.23.11 | |||||
| 运行在以下环境 | |||||||||
| 应用 | envoyproxy | envoy | * | From (including) 1.24.0 | Up to (excluding) 1.24.9 | ||||
| 运行在以下环境 | |||||||||
| 应用 | envoyproxy | envoy | * | From (including) 1.25.0 | Up to (excluding) 1.25.8 | ||||
| 运行在以下环境 | |||||||||
| 应用 | envoyproxy | envoy | * | From (including) 1.26.0 | Up to (excluding) 1.26.3 | ||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | nghttp2 | * | Up to (excluding) 1.46.0-r1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.16 | nghttp2 | * | Up to (excluding) 1.47.0-r1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.17 | nghttp2 | * | Up to (excluding) 1.51.0-r1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | nghttp2 | * | Up to (excluding) 1.amzn2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2023 | nodejs | * | Up to (excluding) 1.amzn2023 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | nghttp2 | * | Up to (excluding) 1.33.0-1.1.7.amzn1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | anolis_os_23 | nghttp2 | * | Up to (excluding) 1.57.0-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP1 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP2 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP3 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_loongarch64_V10SP1 | libnghttp2 | * | Up to (excluding) 1.41.0-3.a.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_loongarch64_V10SP3 | libnghttp2 | * | Up to (excluding) 1.41.0-3.a.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP1 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP2 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP3 | debug/nghttp2-debuginfo、libnghttp2、libnghttp2-devel、nghttp2、nghttp2-help | * | Up to (excluding) 1.41.0-3.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.4 | libnghttp2_asio-devel | * | Up to (excluding) 1.40.0-150200.9.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.5 | libnghttp2_asio-devel | * | Up to (excluding) 1.40.0-150200.9.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | libnghttp2 | * | Up to (excluding) 14-1.39.2-3.10.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | unionos_e | nghttp2 | * | Up to (excluding) nghttp2-1.41.0-5.uel20.4 | |||||
- 攻击路径 本地
- 攻击复杂度 复杂
- 权限要求 普通权限
- 影响范围 越权影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 N/A
| CWE-ID | 漏洞类型 |
| CWE-400 | 未加控制的资源消耗（资源穷尽） |
| CWE-459 | 清理环节不完整 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论