Envoy Resource Management Error Vulnerability

Envoy is an open source distributed proxy server. A resource management error vulnerability exists in Envoy versions prior to 1.29.1, which results from a denial of service when configuring the URI template matcher using regular expressions...

EulerOS Virtualization 2.10.0 : nghttp2 (EulerOS-SA-2023-3478)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS Virtualization 2.10.1 : nghttp2 (EulerOS-SA-2023-3506)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2023-3015)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

EulerOS Virtualization 2.9.1 : nghttp2 (EulerOS-SA-2024-1045)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS Virtualization 2.11.1 : nghttp2 (EulerOS-SA-2023-3363)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS 2.0 SP10 : nghttp2 (EulerOS-SA-2023-3224)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

EulerOS 2.0 SP9 : nghttp2 (EulerOS-SA-2023-3346)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

EulerOS 2.0 SP10 : nghttp2 (EulerOS-SA-2023-3189)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

EulerOS 2.0 SP11 : nghttp2 (EulerOS-SA-2023-3038)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

EulerOS Virtualization 2.9.0 : nghttp2 (EulerOS-SA-2024-1019)

According to the versions of the nghttp2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping...

EulerOS 2.0 SP9 : nghttp2 (EulerOS-SA-2023-3314)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's HTTP/2 codec may leak a header map and bookkeeping structures upon...

PT-2024-2652 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions 1.29.0 through 1.29.1 Description: The issue is related to the Envoy HTTP/2 protocol stack, which is vulnerable to a flood of CONTINUATION frames. This occurs because Envoy's HTTP/2 codec does not reset a request when header ma...

PT-2024-2651 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.29.3 Envoy versions prior to 1.28.2 Envoy versions prior to 1.27.4 Envoy versions prior to 1.26.8 Description: The HTTP/2 protocol stack in Envoy is vulnerable to CPU exhaustion due to a flood of CONTINUATION frames...

Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2023-3506)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: volume-modifier-for-k8s, kubernetes-csi-external-resizer, temporal-server, kine, kubernetes, k3s, metrics-server, envoy-ratelimit, kubevela, buildkitd, cri-tools, kubescape, temporal, docker-compose...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: slsa-verifier, scorecard, plutono-fips, bank-vaults-fips, terraform-provider-sendgrid, aactl, prometheus-stackdriver-exporter, k3d, kube-oidc-proxy, conftest-fips, kubernetes-csi-livenessprobe-fips, kubescape, src, kiam, up, volume-modifier-for-k8s-fips, kubeflow-fip...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, k3d, kubeflow, scorecard, kubevela, src, spark-operator, buildkitd, cortex, kubescape, up, aactl, slsa-verifier, dgraph...

GHSA-9WMC-RG4H-28WV github.com/kumahq/kuma affected by CVE-2023-44487

Impact Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RSTSTREAM frames. This can be exercised if you use the builtin gateway and receive untrusted http2 traffic. Patches...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: certificate-transparency, git-lfs, ollama, fuse-overlayfs-snapshotter, helm, sigstore-scaffolding, weaviate, flux-helm-controller, metrics-server, nginx-stable, kubescape, frp, k3d, gitness, gke-gcloud-auth-plugin, kubernetes-csi-livenessprobe, cosign,...