CVE-2023-41378
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-703, CWE-755
- Affected
- tigera/calico cloud · tigera/calico enterprise · tigera/calico os
- Source
- psirt@tigera.io
References
- https://github.com/projectcalico/calico/pull/7908Issue Tracking
- https://github.com/projectcalico/calico/pull/7993Issue Tracking, Patch
- https://www.tigera.io/security-bulletins-tta-2023-001/Vendor Advisory
- https://github.com/projectcalico/calico/pull/7908Issue Tracking
- https://github.com/projectcalico/calico/pull/7993Issue Tracking, Patch
- https://www.tigera.io/security-bulletins-tta-2023-001/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.