Skip to content
OpenAdvisories
Medium WID-SEC-2025-0589 3 CVEs

Google Cloud Platform: Mehrere Schwachstellen ermöglichen Denial of Service

Published Mar 18, 2025 · Updated Mar 18, 2025 · de-DE

Vendor: Google Product: Cloud Platform Platform: Linux

Summary

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Google Cloud Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Google Cloud Platform (GCP) ist eine Sammlung von Cloud-Computing-Diensten von Google, die Infrastruktur, Datenanalyse, maschinelles Lernen und Entwicklungstools bietet. Unternehmen können dadurch Anwendungen in der Cloud zu aufbauen und skalierbar bereitzustellen.

Vulnerabilities 3

  • High 7.5
    CVE-2024-53270

    HTTP/1: sending overload crashes when the request is reset beforehand in envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, …

    envoyproxy envoy
  • High 7.1
    CVE-2024-53271

    HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5…

    envoyproxy envoy
  • Medium 4.5
    CVE-2024-53269

    Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy

    Envoy is a cloud-native high-performance edge/middle/service proxy. When additional address are not ip addresses, then the Happy Eyeballs sorting algorithm will crash in data plane. This issue has been addressed in releases 1.32.2, 1.31.4, and 1.30.8. Users a…

    envoyproxy envoy

Revision history

  1. #1

    Initiale Fassung

References