Vulnerability Details CVE-2023-35942
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is drained. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, disable gRPC access log or stop listener update.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 4.1%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2023-35942
-
cpe:2.3:a:envoyproxy:envoy:1.23.0
-
cpe:2.3:a:envoyproxy:envoy:1.23.1
-
cpe:2.3:a:envoyproxy:envoy:1.23.10
-
cpe:2.3:a:envoyproxy:envoy:1.23.11
-
cpe:2.3:a:envoyproxy:envoy:1.23.2
-
cpe:2.3:a:envoyproxy:envoy:1.23.3
-
cpe:2.3:a:envoyproxy:envoy:1.23.4
-
cpe:2.3:a:envoyproxy:envoy:1.23.5
-
cpe:2.3:a:envoyproxy:envoy:1.23.6
-
cpe:2.3:a:envoyproxy:envoy:1.23.7
-
cpe:2.3:a:envoyproxy:envoy:1.23.8
-
cpe:2.3:a:envoyproxy:envoy:1.23.9
-
cpe:2.3:a:envoyproxy:envoy:1.24.0
-
cpe:2.3:a:envoyproxy:envoy:1.24.1
-
cpe:2.3:a:envoyproxy:envoy:1.24.2
-
cpe:2.3:a:envoyproxy:envoy:1.24.3
-
cpe:2.3:a:envoyproxy:envoy:1.24.4
-
cpe:2.3:a:envoyproxy:envoy:1.24.5
-
cpe:2.3:a:envoyproxy:envoy:1.24.6
-
cpe:2.3:a:envoyproxy:envoy:1.24.7
-
cpe:2.3:a:envoyproxy:envoy:1.24.8
-
cpe:2.3:a:envoyproxy:envoy:1.24.9
-
cpe:2.3:a:envoyproxy:envoy:1.25.0
-
cpe:2.3:a:envoyproxy:envoy:1.25.1
-
cpe:2.3:a:envoyproxy:envoy:1.25.2
-
cpe:2.3:a:envoyproxy:envoy:1.25.3
-
cpe:2.3:a:envoyproxy:envoy:1.25.4
-
cpe:2.3:a:envoyproxy:envoy:1.25.5
-
cpe:2.3:a:envoyproxy:envoy:1.25.6
-
cpe:2.3:a:envoyproxy:envoy:1.25.7
-
cpe:2.3:a:envoyproxy:envoy:1.25.8
-
cpe:2.3:a:envoyproxy:envoy:1.26.0
-
cpe:2.3:a:envoyproxy:envoy:1.26.1
-
cpe:2.3:a:envoyproxy:envoy:1.26.2
-
cpe:2.3:a:envoyproxy:envoy:1.26.3