v1.31.2

envoyproxy/envoyv1.31.2Sep 19, 2024by publish-envoy[bot]

AI Summary

Security release addressing multiple CVEs including HTTP/2 crashes, log injection, and various crash fixes.

Key Highlights

Fixes for CVE-2024-45807 (HTTP/2 crash)
Fixes for CVE-2024-45808 (Malicious log injection)
Fixes for CVE-2024-45806 (X-envoy header manipulation)
Fixes for CVE-2024-45809 (JWT filter crash)
Fixes for CVE-2024-45810 (LocalReply crash)

Full Release Notes

[CVE-2024-45807](https://github.com/envoyproxy/envoy/security/advisories/GHSA-qc52-r4x5-9w37): oghttp2 crash on OnBeginHeadersForStream
[CVE-2024-45808](https://github.com/envoyproxy/envoy/security/advisories/GHSA-p222-xhp9-39rc): Malicious log injection via access logs
[CVE-2024-45806](https://github.com/envoyproxy/envoy/security/advisories/GHSA-ffhv-fvxq-r6mf): Potential manipulate `x-envoy` headers from external sources
[CVE-2024-45809](https://github.com/envoyproxy/envoy/security/advisories/GHSA-wqr5-qmq7-3qw3): Jwt filter crash in the clear route cache with remote JWKs
[CVE-2024-45810](https://github.com/envoyproxy/envoy/security/advisories/GHSA-qm74-x36m-555q): Envoy crashes for LocalReply in http async client

**Docker images**:
    https://hub.docker.com/r/envoyproxy/envoy/tags?page=1&name=v1.31.2
**Docs**:
    https://www.envoyproxy.io/docs/envoy/v1.31.2/
**Release notes**:
    https://www.envoyproxy.io/docs/envoy/v1.31.2/version_history/v1.31/v1.31.2
**Full changelog**:
    https://github.com/envoyproxy/envoy/compare/v1.31.1...v1.31.2

Signed-off-by: Boteng Yao <boteng@google.com>
Signed-off-by: Ryan Northey <ryan@synca.io>