In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.

An update of the calico package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1,
    v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely,
    resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for
    loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other
    connections will be idle waiting for that handshake to finish. (CVE-2023-41378)

ID	Name	Product	Family	Type	Severity
332165	Photon OS 5.0: Calico PHSA-2023-5.0-91-0152	Nessus	PhotonOS Local Security Checks	Local	high
410994	SCA: security update for github.com/projectcalico/calico (GHSA-5r5h-q934-cccp)	Tenable Cloud Security	SCA Checks	Local	high
410994	SCA: security update for github.com/projectcalico/calico (GHSA-5r5h-q934-cccp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
204497	Photon OS 4.0: Calico PHSA-2023-4.0-0518	Nessus	PhotonOS Local Security Checks	Local	high
204312	Photon OS 5.0: Calico PHSA-2023-5.0-0152	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2023-41378

high

Tenable Plugins

high

high

high

high

high