Envoy 输入验证错误漏洞

Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to integer overflow, which can be exploited by an attacker with an excessive grpc-timeout value to cause an unexpected timeout calculation...

Envoy 安全漏洞

Envoy is an open source distributed proxy server. Envoy suffers from a security vulnerability that can be exploited by attackers to cause a denial of service due to null references...

Envoy 代码问题漏洞

Envoy is an open source distributed proxy server. versions prior to Envoy 1.71.1 are vulnerable to a null pointer dereference vulnerability, which can be exploited by attackers to crash the program...

OSV-2019-1 ASSERT: bufferRemainingSize() >= length.

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18431 Crash type: ASSERT Crash state: bufferRemainingSize = length. Envoy::Http::Http1::ConnectionImpl::copyToBuffer Envoy::Http::Http1::RequestStreamEncoderImpl::encodeHeaders...

Photon OS 2.0: Envoy PHSA-2021-2.0-0326

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0326. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid147949...

Envoy licensing issue vulnerability

Envoy is an open source distributed proxy server. Envoy is vulnerable to an authorization issue, which could be exploited by an attacker to bypass authentication by providing a JWT token to an issuer that is not in the provider list...

CVE-2021-21378

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

CVE-2021-21378

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

Authentication flaw

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

CVE-2021-21378 JWT authentication bypass with unknown issuer token

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allowmissing requirement under...

CVE-2021-21378

Summary of CVE-2021-21378 (Envoy): In Envoy 1.17.0, the JWT Authentication filter can bypass authentication when configured with the allowed-missing option under requires_any, due to a faulty handling of an unknown issuer. A JwtUnknownIssuer error was mistakenly converted to JwtMissed, causing a ...

PT-2021-14460 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy version 1.17.0 Description: The issue allows an attacker to bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the allow missing...

Envoy 授权问题漏洞

Envoy is an open source distributed proxy server. Envoy is vulnerable to an authorization issue, which could be exploited by an attacker to bypass authentication by providing a JWT token to an issuer that is not in the provider list...

Important Photon OS Security Update - PHSA-2021-0326

Updates of 'envoy', 'kubernetes' packages of Photon OS have been released...

CVE-2021-21378

An authentication bypass vulnerability was found in envoyproxy/envoy. When specifying a JSON Web Token JWT authentication filter, if allowmissing is also used, this flaw allows an attacker to craft a request with a JWT token with an incorrect issuer bypassing the filter. The highest threat from...

Denial Of Service (DoS)

github.com/istio/istio is vulnerable to denial of service DoS. The vulnerability exists through a NULL pointer dereference in pilot/pkg/proxy/envoy/v2/debug.go through the getResoourceVersion function...

OSV-2018-117 Heap-buffer-overflow in Envoy::StringUtil::itoa

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10038 Crash type: Heap-buffer-overflow WRITE 1 Crash state: Envoy::StringUtil::itoa Envoy::Http::HeaderString::setInteger Envoy::TestOneProtoInput...

OSV-2018-95 Heap-use-after-free in Envoy::FakeConnectionBase::close

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8783 Crash type: Heap-use-after-free READ 1 Crash state: Envoy::FakeConnectionBase::close Envoy::Event::DispatcherImpl::runPostCallbacks eventprocessactivesinglequeue...

Unspecified vulnerability in Envoy (CNVD-2021-07242)

Envoy is an open source distributed proxy server . A security vulnerability exists in versions prior to Envoy 1.16.1 that stems from logging an incorrect downstream address because it only considers directly connected peers and not the information in the proxy protocol header. This affects cases...

Envoy has an unspecified vulnerability

Envoy is an open source distributed proxy server . A security vulnerability exists in versions prior to Envoy 1.16.1 that stems from incorrect handling of dropped and truncated datagrams, as evidenced by a UDP packet size greater than 1500 segmentation error. No details of the vulnerability are...