SSRF in Linkerd Linkerd2
CVE-2024-40632
Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.004 (36.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Linkerd Linkerd2 — versions < edge-24.6.2
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-40632?
- CVE-2024-40632 is a low-severity vulnerability in Linkerd Linkerd2, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.7/10. Published 2024-07-15.
- How severe is CVE-2024-40632?
- Low severity. CVSS v3 base score is 3.7 out of 10.