CVE-2023-41378

HIGH7.5EPSS 0.22%

Calico Typha denial of service vulnerability

發布日:2023/11/6修改日:2026/2/4

也稱為:GHSA-5r5h-q934-cccpCGA-38v3-f6j6-gj53

描述

In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.

受影響套件(1)

Go/github.com/projectcalico/calico>= 3.26.0, < 3.26.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-41378
PATCHhttps://github.com/projectcalico/calico
WEBhttps://github.com/projectcalico/calico/commit/2ebc1f92ecc39332cf1d55ba676d9101af24982f
WEBhttps://github.com/projectcalico/calico/commit/ad8bd001e650ec7742ac30e58247e7eef5956125
WEBhttps://github.com/projectcalico/calico/pull/7908
WEBhttps://github.com/projectcalico/calico/pull/7993
WEBhttps://www.tigera.io/security-bulletins-tta-2023-001