CVE-2023-41378

CVSS V2 None CVSS V3 None
Description
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.
Overview
  • CVE ID
  • CVE-2023-41378
  • Assigner
  • Tigera
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-11-06T15:00:53.249Z
  • Last Modified Date
  • 2023-11-06T15:00:53.249Z
Weakness Enumerations
CWE URL
CWE-400 http://cwe.mitre.org/data/definitions/400.html
CWE-703 http://cwe.mitre.org/data/definitions/703.html
References
Reference URL Reference Tags
https://www.tigera.io/security-bulletins-tta-2023-001/ vendor-advisory release-notes
https://github.com/projectcalico/calico/pull/7908 issue-tracking
https://github.com/projectcalico/calico/pull/7993 patch
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-41378
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-41378
History
Created Old Value New Value Data Type Notes
2024-06-25 03:34:03 Added to TrackCVE