Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, disable gRPC access log or stop listener update.
History

Thu, 24 Oct 2024 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-07-25T18:24:11.613Z

Updated: 2024-10-24T18:01:03.748Z

Reserved: 2023-06-20T14:02:45.596Z

Link: CVE-2023-35942

cve-icon Vulnrichment

Updated: 2024-08-02T16:37:40.039Z

cve-icon NVD

Status : Modified

Published: 2023-07-25T19:15:11.050

Modified: 2024-11-21T08:09:01.420

Link: CVE-2023-35942

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-07-25T00:00:00Z

Links: CVE-2023-35942 - Bugzilla