{
  "cveId": "CVE-2024-45808",
  "url": "https://patchblox.com/security/cve/CVE-2024-45808",
  "summary": "CVE-2024-45808 is fixed in ecs-service-connect-agent on 1 platform by ALAS2023-2026-1603 (version v1.29.9.0-1.amzn2023), released April 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ecs-service-connect-agent: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2024-7264:\n\tlibcurl\u0027s...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2024-7264:\n\tlibcurl\u0027s ASN1 parser code has the \u0060GTime2str()\u0060 function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na \u0060strlen()\u0060 getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.\n\nCVE-2024-45810:\n\tEnvoy is a cloud-native high-performance edge/middle/service proxy. Envoy will crash when the http async client is handling \u0060sendLocalReply\u0060 under some circumstance, e.g., websocket upgrade, and requests mirroring. The http async client will crash during the \u0060sendLocalReply()\u0060 in http async client, one reason is http async client is duplicating the status code, another one is the destroy of router is called at the destructor of the async stream, while the stream is deferred deleted at first. There will be problems that the stream decoder is destroyed but its reference is called in \u0060router.onDestroy()\u0060, causing segment fault. This will impact ext_authz if the \u0060upgrade\u0060 and \u0060connection\u0060 header are allowed, and request mirrorring. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nCVE-2024-45809:\n\tEnvoy is a cloud-native high-performance edge/middle/service proxy. Jwt filter will lead to an Envoy crash when clear route cache with remote JWKs. In the following case: 1. remote JWKs are used, which requires async header processing; 2. clear_route_cache is enabled on the provider; 3. header operations are enabled in JWT filter, e.g. header to claims feature; 4. the routing table is configured in a way that the JWT header operations modify requests to not match any route. When these conditions are met, a crash is triggered in the upstream code due to nullptr reference conversion from route(). The root cause is the ordering of continueDecoding and clearRouteCache. This issue has been addressed in versions 1.31.2, 1.30.6, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nCVE-2024-45808:\n\tEnvoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the \u0060REQUESTED_SERVER_NAME\u0060 field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nCVE-2024-45806:\n\tEnvoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy\u0027s default configuration of internal trust boundaries, which considers all RFC1918 private address ranges as internal. The default behavior for handling internal addresses in Envoy has been changed. Previously, RFC1918 IP addresses were automatically considered internal, even if the internal_address_config was empty.  The default configuration of Envoy will continue to trust internal addresses while in this release and it will not trust them by default in next release. If you have tooling such as probes on your private network which need to be treated as trusted (e.g. changing arbitrary x-envoy headers) please explicitly include those addresses or CIDR ranges into \u0060internal_address_config\u0060. Successful exploitation could allow attackers to bypass security controls, access sensitive data, or disrupt services within the mesh, like Istio. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
  "published": "2026-04-27T09:00:00Z",
  "severity": "moderate",
  "epss": 0.00351,
  "epssPercentile": 0.28928,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ecs-service-connect-agent",
      "release": "amzn 2023",
      "fixedVersion": "v1.29.9.0-1.amzn2023",
      "fix": "ALAS2023-2026-1603",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1603",
      "released": "2026-04-27T09:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T01:44:33Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}