---
title: "Security Bulletins – TTA-2023-001, CVE-2023-41378"
source: "https://www.tigera.io/security-bulletins-tta-2023-001/"
---

# Security Bulletins

Calico Typha hangs during unclean TLS handshake

Description
Severity
Notes

## Calico Typha hangs during unclean TLS handshake

Reference: TTA-2023-001, CVE-2023-41378

Date published: November 06, 2023 (Updated)

High
N/A

### Summary

In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.

### Severity

CVSSv3.1: High (7.5)

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Calico Typha service port by default is only accessible within the cluster or via the node IP when operating in the host network. Denial of service of a single Calico Typha instance will not disrupt the operations of the cluster. Only in certain conditions where abrupt terminations of the TLS handshake with Typha and all replicas will disrupt the operation of the cluster.

### References

- [https://nvd.nist.gov/vuln/detail/CVE-2023-41378](https://nvd.nist.gov/vuln/detail/CVE-2023-41378)

- [https://github.com/projectcalico/calico/issues/7908](https://github.com/projectcalico/calico/issues/7908)

- [https://github.com/projectcalico/calico/pull/7993](https://github.com/projectcalico/calico/pull/7993)

### Weakness Enumeration

[CWE-400](https://cwe.mitre.org/data/definitions/400.html): Uncontrolled Resource Consumption

[CWE-703](https://cwe.mitre.org/data/definitions/703.html): Improper Check or Handling of Exceptional Conditions

### Indicators of Impact/Compromise

Review flow logs for unexpected connections to calico-typha or private IP addresses on TCP port 5473. Indicators of impact include the Calico Felix pod crash looping or not reaching readiness state.

### Workaround/Mitigation

Review host and cluster network policies and secure Typha port 5473 from external access to the cluster using host-endpoint policies, external security groups, access control lists, or firewalls.

### Affected Releases

- Calico OSS - v3.26.2 and below - v3.25.1 and below

- Calico Enterprise - v3.17.1 and below - v3.16.3 and below - v3.15.3 and below

- Calico Cloud - v17.1.1 and below

### Fixed Versions

- Calico OSS - v3.26.3 – released Oct 6, 2023 - v3.25.2 – released Sept 5, 2023

- Calico Enterprise - v3.18.0 – released Sept 1, 2023 - v3.17.2 – released Oct 3, 2023 - v3.16.4 – released Sept 23, 2023 - v3.15.4 – released Sept 12, 2023

- Calico Cloud - v18.0.0

### Acknowledgments

Rodrigo Fior Kuntzer of Miroapp (Github: @rodrigorfk) for discovery and partial fix.

[Return to List](https://www.tigera.io/security-bulletins/)

<!-- plugin=object-cache-pro client=phpredis metric#hits=2703 metric#misses=33 metric#hit-ratio=98.8 metric#bytes=1393324 metric#prefetches=0 metric#store-reads=138 metric#store-writes=13 metric#store-hits=118 metric#store-misses=22 metric#sql-queries=29 metric#ms-total=930.01 metric#ms-cache=57.74 metric#ms-cache-avg=0.3849 metric#ms-cache-ratio=6.2 sample#redis-hits=40912432 sample#redis-misses=11465802 sample#redis-hit-ratio=78.1 sample#redis-ops-per-sec=51 sample#redis-evicted-keys=0 sample#redis-used-memory=94250672 sample#redis-used-memory-rss=89661440 sample#redis-memory-fragmentation-ratio=0.9 sample#redis-connected-clients=1 sample#redis-tracking-clients=0 sample#redis-rejected-connections=0 sample#redis-keys=42817 -->