1990 matches found
CVE-2023-2816 Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the services corresponding to those...
Consul Envoy Extension Downstream Proxy Configuration By Upstream Service Owner
Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” such that any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permissi...
PT-2023-21601 · Hashicorp · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: Consul and Consul Enterprise affected versions not specified Description: The issue allows any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the...
HashiCorp Consul 安全漏洞
HashiCorp Consul is a suite of distributed, highly available data center-aware solutions from HashiCorp USA. The product is used to connect and provision applications across a dynamically distributed infrastructure. A security vulnerability exists in HashiCorp Consul, Consul Enterprise versions...
Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-165)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-165 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT...
Important: ecs-service-connect-agent
Issue Overview: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT checks and forge fake original paths. The header x-envoy-original-path should be an interna...
Important: ecs-service-connect-agent
Issue Overview: Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT checks and forge fake original paths. The header x-envoy-original-path should be an interna...
The vulnerability of the Envoy proxy server, related to insufficient validation of input data, allows attackers to bypass authentication procedures and gain unauthorized access to protected information.
The vulnerability of the Envoy proxy server is related to insufficient validation of input data during the processing of the x-envoy-original-path header. Exploiting this vulnerability allows a malicious actor to bypass authentication using a JSON Web Token JWT and gain unauthorized access to...
The vulnerability in the implementation of the mTLS protocol for the Envoy proxy server allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the mTLS protocol implementation in Envoy proxy servers is related to insufficient validation of input data during the processing of HTTP headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests HTTP Request Smuggling attack...
CVE-2023-27496
A flaw was found in Envoy. If Envoy is running with the OAuth filter enabled, a malicious actor could construct a request which would cause denial of service, crashing Envoy...
CVE-2023-27493
A flaw was found in Envoy. Envoy doesn't escape HTTP header values due to a specifically constructed HTTP request or mTLS connection with a specifically crafted client certificate. Envoy configuration must also include an option to add request headers that were generated using inputs from the...
CVE-2023-27492
A flaw was found in Envoy. This issue may allow attackers to send large request bodies for routes that have the Lua filter enabled, which will trigger a crash...
CVE-2023-27491
A flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the upstream HTTP/1 service...
CVE-2023-27488
A flaw was found in Envoy which could allow an attacker to bypass authentication checks when extauthz is used by crafting a malicious http header with a non-UTF8 value...
CVE-2023-27496 vulnerabilities
Vulnerabilities for packages: envoy...
CVE-2023-27496 vulnerabilities
Vulnerabilities for packages: envoy...
CVE-2023-27493 vulnerabilities
Vulnerabilities for packages: envoy...
CVE-2023-27496
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a state query param is present on any response that looks like an OAuth redirect response. Sending it a request with t...
CVE-2023-27493
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values ...