title: Calico Typha hangs during unclean TLS handshake
description: In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake can block the Calico Typha server indefinitely, resulting in denial of service. The TLS Handshake() call is performed inside the main server handle for loop without any timeout allowing an unclean TLS handshake to block the main loop indefinitely while other connections will be idle waiting for that handshake to finish.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
defaultStatus: unaffected
product: Typha
vendor: Calico
versions:
lessThanOrEqual: v3.26.2, status: affected, version: v3.26.0, versionType: semver
lessThanOrEqual: v3.25.1, status: affected, version: 0, versionType: semver
}
{
defaultStatus: unaffected
product: Typha
vendor: Tigera
versions:
lessThanOrEqual: v3.17.1, status: affected, version: v3.17.0, versionType: semver
lessThanOrEqual: v3.16.3, status: affected, version: v3.16.0, versionType: semver
lessThanOrEqual: v3.15.3, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL