CVE-2023-41378

ADVISORY - github

Summary

In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.

EPSS Score⁠: 0.00225 (0.448)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-400⁠

Uncontrolled Resource Consumption

CWE-703⁠

Improper Check or Handling of Exceptional Conditions

CWE-755⁠

Improper Handling of Exceptional Conditions

ADVISORY - github

CWE-400⁠

Uncontrolled Resource Consumption

CWE-755⁠

Improper Handling of Exceptional Conditions

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-755⁠

Improper Handling of Exceptional Conditions

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

Impacted images

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.