Upgrade Envoy Proxy to resolve CVE-2024-30255

emissary-ingress / emissary

open source Kubernetes-native API gateway for microservices built on the Envoy Proxy

https://www.getambassador.io

Apache License 2.0

4.32k stars 684 forks source link

Upgrade Envoy Proxy to resolve CVE-2024-30255 #5627

Open ZiqianXu opened 2 months ago

ZiqianXu commented 2 months ago

Describe the bug Envoy Proxy has published a security advisory regarding CVE-2024-30255 HTTP/2: CPU exhaustion due to CONTINUATION frame flood. Is Emissary-ingress affected by CVE-2024-30255? If so, should it be upgraded to the fixed Envoy release 1.28.2?

Thanks!

cindymullins-dw commented 2 months ago

Ambassador will push a PR to address this soon (Moderate security level) but we are not planning any releases at this time. The Emissary release schedule now depends on the Maintainers and is currently TBD (since our decoupling of Emissary releases from the licensed version Edge Stack late last year). It is possible to build Emissary from source to capture PRs that have been merged but not yet released. Feel free to direct questions to me (Cindy Mullins) at a8r.io/slack.