Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: GHSA-cf3q-gqg7-3fm9 #3544

Open
GoVulnBot opened this issue Mar 21, 2025 · 0 comments
Open

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: GHSA-cf3q-gqg7-3fm9 #3544

GoVulnBot opened this issue Mar 21, 2025 · 0 comments
Labels
possibly not Go triaged

Comments

@GoVulnBot
Copy link

Advisory GHSA-cf3q-gqg7-3fm9 references a vulnerability in the following Go modules:

Module
github.com/envoyproxy/envoy

Description:

Summary

Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the fail of a websocket handshake will trigger a local reply leading to the crash of Envoy.

PoC

If both websocket and ext_proc are enabled, a failed handshake will trigger a local reply, thus ext_proc will crash.

Mitigation

  1. Disable websocket traffic
  2. Change the websocket response from backend to always return 101 Switch protocol based on RFC.
  3. Apply the patch and the ext_proc filter will not send the local r...

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/envoyproxy/envoy
      versions:
        - fixed: 1.30.10
        - introduced: 1.31.0
        - fixed: 1.31.6
        - introduced: 1.32.0
        - fixed: 1.32.4
        - introduced: 1.33.0
        - fixed: 1.33.1
      vulnerable_at: 1.33.0
summary: Envoy crashes when HTTP ext_proc processes local replies in github.com/envoyproxy/envoy
cves:
    - CVE-2025-30157
ghsas:
    - GHSA-cf3q-gqg7-3fm9
references:
    - advisory: https://github.com/advisories/GHSA-cf3q-gqg7-3fm9
    - advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-cf3q-gqg7-3fm9
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-30157
    - fix: https://github.com/envoyproxy/envoy/commit/8eda1b8ef5ba8663d16a737ab99458c039a9b53c
source:
    id: GHSA-cf3q-gqg7-3fm9
    created: 2025-03-21T16:01:33.60117419Z
review_status: UNREVIEWED
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
possibly not Go triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@thatnealpatel @GoVulnBot