id: GO-ID-PENDING
modules:
- module: github.com/envoyproxy/envoy
vulnerable_at: 1.31.2
summary: CVE-2024-45806 in github.com/envoyproxy/envoy
cves:
- CVE-2024-45806
references:
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45806
- web: https://github.com/envoyproxy/envoy/security/advisories/GHSA-ffhv-fvxq-r6mf
source:
id: CVE-2024-45806
created: 2024-09-20T01:01:20.210032458Z
review_status: UNREVIEWED
Advisory CVE-2024-45806 references a vulnerability in the following Go modules:
Description:
Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically considered internal, even if the internal_address_config was empty. The defa...
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.