CVE-2023-27487 Envoy client may fake the header `x-envoy-original-path`

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT checks and forge fake original paths. The header x-envoy-original-path should be an internal header, but...

CVE-2023-27487 Envoy client may fake the header `x-envoy-original-path`

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token JWT checks and forge fake original paths. The header x-envoy-original-path should be an internal header, but...

PT-2023-21171 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 Description: The OAuth filter in Envoy assumes that a state query param is present on a...

Envoy 环境问题漏洞

Envoy is an open source distributed proxy server. An environmental issue vulnerability exists in Envoy that stems from the fact that Envoy does not clean up or escape request attributes when generating request headers...

PT-2023-21167 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 Description: Envoy is an open source edge and service proxy designed for cloud-native...

Envoy 输入验证错误漏洞

Envoy is an open source distributed proxy server. Envoy suffers from an input validation error vulnerability that stems from the possibility that a client could bypass JSON Web Token JWT checks and forge a forged original path...

Envoy 输入验证错误漏洞

Envoy is an open source distributed proxy server. An input validation error vulnerability exists in versions of Envoy after 1.22.9. An attacker could exploit this vulnerability to cause an Envoy process to terminate abnormally...

Envoy 输入验证错误漏洞

Envoy is an open source distributed proxy server. Envoy suffers from an input validation error vulnerability that stems from the ability to escalate privileges when failuremodeallow: true is configured for the extauthz filter...

Envoy 安全漏洞

Envoy is an open source distributed proxy server.Lua is a lightweight, extensible open source scripting language from the LUA team. A security vulnerability exists in Envoy that stems from the vulnerability of Lua filters to denial-of-service attacks...

PT-2023-21168 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 Description: The Lua filter in Envoy is vulnerable to denial of service. Attackers can...

Envoy 环境问题漏洞

Envoy is an open source distributed proxy server. Envoy suffers from an environmental issue vulnerability that stems from an incompatible HTTP/1 service that allows misformatted requests, which can lead to security policy bypass. The following versions are affected: versions prior to 1.26.0,...

PT-2023-21163 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 Description: The issue concerns escalation of privileges when failure mode allow: true is configured for the ext authz filter in Envoy, an open source edge and service proxy...

PT-2023-2245 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 Description: The issue is related to the insufficient sanitization of request propertie...

PT-2023-2250 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 Description: The issue is related to insufficient input validation when processing the...

SUSE CVE-2019-18801

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents leading to a query-of-death scenario or may be used to bypass Envoy's...

SUSE CVE-2019-18802

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header such as Host with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass...

SUSE CVE-2019-18838

An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An...

SUSE CVE-2019-18836

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continueonlistenerfilterstimeout is used."...

SUSE CVE-2020-8663

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections...

SUSE CVE-2020-12604

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream...