openSUSE 15 Security Update : envoy-proxy (openSUSE-SU-2022:0065-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0065-1 advisory. - Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with...

OPENSUSE-SU-2022:0065-1 Security update for envoy-proxy

This update for envoy-proxy fixes the following issues: Update to 1.14.6: - CVE-2020-35471: Fixed a denial of service via dropped and truncated UDP datagrams boo1180121...

Security update for envoy-proxy (important)

openSUSE Security Update: Security update for envoy-proxy Announcement ID: openSUSE-SU-2022:0065-1 Rating: important References: 1167073 1173559 1180121 Cross-References: CVE-2020-12603 CVE-2020-12604 CVE-2020-12605 CVE-2020-35471 CVE-2020-8663 CVSS scores: CVE-2020-12603 NVD : 7.5...

CVE-2022-21655 Incorrect handling of internal redirects results in crash in Envoy

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal...

Envoy 资源管理错误漏洞

Envoy is an open source distributed proxy server. Envoy is vulnerable to a resource management error that occurs when configuring "envoyv3apifieldextensions.filters.network.tcpproxy.v3. tunnelingconfig" crashes and the downstream connection is disconnected while the upstream connection or http/2...

Envoy 信任管理问题漏洞

Envoy is an open source distributed proxy server. Envoy is vulnerable to trust management issues, and no detailed vulnerability details are available at this time...

PT-2022-15009 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue concerns Envoy, an open source edge and service proxy for cloud-native applications. It allows the re-use of TLS when certain certificate validation settings have changed from their...

Authorization Policy Bypass Due to Case Insensitive Host Comparison

Impact According to RFC 4343, Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy...

GHSA-7774-7VR3-CC8J Authorization Policy Bypass Due to Case Insensitive Host Comparison

Impact According to RFC 4343, Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy...

envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies

An authorization bypass vulnerability was found in envoyproxy/envoy. Envoy incorrectly evaluates an HTTP request with multiple value headers. This flaw allows an attacker to bypass rule policies that use the extauthz extension. The highest threat from this vulnerability is to confidentiality,...

envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies

An authorization bypass vulnerability was found in envoyproxy/envoy. When a URI path-based authorization policy is specified, envoy incorrectly evaluates the HTTP request which contains a URI fragment. This flaw allows an attacker to bypass the authorization policy and access downstream services...

envoyproxy/envoy: denial of service when using extensions that modify request or response sizes

An out-of-bounds memory read vulnerability was found in envoyproxy/envoy. When using one of the following envoy extensions, it is possible to modify and increase the request or response body size of the following: the decompressor, json-transcoder, grpc-web, or other proprietary extensions. This...

envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies

An authorization bypass vulnerability was found in envoyproxy/envoy. When a URI path-based authorization policy is specified, envoy incorrectly evaluates the HTTP request which contains a URI fragment. This flaw allows an attacker to bypass the authorization policy and access downstream services...

envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies

An authorization bypass vulnerability was found in envoyproxy/envoy. Envoy incorrectly evaluates an HTTP request with multiple value headers. This flaw allows an attacker to bypass rule policies that use the extauthz extension. The highest threat from this vulnerability is to confidentiality,...

CVE-2021-32779 Incorrectly handling of URI '#fragment' element as part of the path element

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI 'fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with...

Envoy SQL注入漏洞

Envoy is an open source distributed proxy server . envoyproxy envoy SQL injection vulnerability can be exploited by an attacker to cause a denial of service on the proxy...

Envoy 代码问题漏洞

Envoy is an open source distributed proxy server. A code issue vulnerability exists in the Envoy functionality that stems from an invalid state transition from CLOSED to DRAINING in the same I/O event...

Envoy 缓冲区错误漏洞

Envoy is an open source distributed proxy server. Envoy suffers from a buffer error vulnerability that can be exploited by an attacker to trigger a denial of service...

CVE-2021-32783

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy...

Code injection

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy...