Change Details

For T380211 we're upgrading from 1.23 (July 2022) all the way to something from this year. Because we've gotten so far behind, I'll be making the upgrade in a few steps, starting with a move to 1.26. We were also unable to build 1.24 or better on buster's version of libc. Now that no buster hosts are left running Envoy, this will move the build (and minimum supported distribution) to bullseye.

For T380211 we're upgrading from 1.23 (July 2022) all the way to something from this year. Because we've gotten so far behind, I'll be making the upgrade in a few steps, starting with a move to 1.26. We were also unable to build 1.24 or better on buster's version of libc. Now that no buster hosts are left running Envoy, this will move the build (and minimum supported distribution) to bullseye. This update will also fix the following security issues: **Crash in proxy protocol when command type of LOCAL (CVE-2024-23327)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a **Envoy crashes when using an address type that isn’t supported by the OS (CVE-2024-23325)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-5m7c-mrwr-pm26 https://github.com/envoyproxy/envoy/commit/bacd3107455b8d387889467725eb72aa0d5b5237 **Ext_authz can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata (CVE-2024-23324)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6 https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a **Excessive CPU usage when URI template matcher is configured using regex (CVE-2024-23323)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch https://github.com/envoyproxy/envoy/commit/71eeee8f0f0132f39e402b0ee23b361ee2f4e645 **Envoy crashes when idle and request per try timeout occur within the backoff interval (CVE-2024-23322)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38 https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e **Abnormal termination when using auto_sni with :authority header longer than 255 characters (CVE-2024-32475)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382

For T380211 we're upgrading from 1.23 (July 2022) all the way to something from this year. Because we've gotten so far behind, I'll be making the upgrade in a few steps, starting with a move to 1.26. We were also unable to build 1.24 or better on buster's version of libc. Now that no buster hosts are left running Envoy, this will move the build (and minimum supported distribution) to bullseye. This update will also fix the following security issues: **Crash in proxy protocol when command type of LOCAL (CVE-2024-23327)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-4h5x-x9vh-m29j https://github.com/envoyproxy/envoy/commit/63895ea8e3cca9c5d3ab4c5c128ed1369969d54a **Envoy crashes when using an address type that isn’t supported by the OS (CVE-2024-23325)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-5m7c-mrwr-pm26 https://github.com/envoyproxy/envoy/commit/bacd3107455b8d387889467725eb72aa0d5b5237 **Ext_authz can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata (CVE-2024-23324)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-gq3v-vvhj-96j6 https://github.com/envoyproxy/envoy/commit/29989f6cc8bfd8cd2ffcb7c42711eb02c7a5168a **Excessive CPU usage when URI template matcher is configured using regex (CVE-2024-23323)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-x278-4w4x-r7ch https://github.com/envoyproxy/envoy/commit/71eeee8f0f0132f39e402b0ee23b361ee2f4e645 **Envoy crashes when idle and request per try timeout occur within the backoff interval (CVE-2024-23322)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-6p83-mfmh-qv38 https://github.com/envoyproxy/envoy/commit/843f9e6a123ed47ce139b421c14e7126f2ac685e **Abnormal termination when using auto_sni with :authority header longer than 255 characters (CVE-2024-32475)** https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wj https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382