Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0335

An update of 'envoy', 'apache-ant' packages of Photon OS has been released...

Important Photon OS Security Update - PHSA-2020-0335

Updates of 'envoy', 'apache-ant' packages of Photon OS have been released...

Envoy has an unspecified vulnerability (CNVD-2021-58578)

Envoy is an open source distributed proxy server. security vulnerabilities exist in versions prior to Envoy 1.15.0. No details of the vulnerability are currently available...

Envoy has an unspecified vulnerability (CNVD-2021-58577)

Envoy is an open source distributed proxy server. a security vulnerability exists in Envoy, which stems from the fact that Envoy hosts between 2d69e30 and 3b5acb2 may not be able to resolve request URLs that require host normalization. no details of the vulnerability are currently available...

envoy:health_check_fuzz_test: Crash in std::__1::vector<std::__1::unique_ptr<Envoy::Upstream::HttpHealthCheckerImplTest

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5662540920782848 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: healthcheckfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001990 Cra...

envoy:health_check_fuzz_test: Crash in Envoy::Upstream::TcpHealthCheckFuzz::raiseEvent

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5704831886688256 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: healthcheckfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000000019a0 Cra...

CVE-2020-25018

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...

CVE-2020-25017

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy header map API does not replace all existing occurences of a non-inline header...

CVE-2020-25018

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...

CVE-2020-25017

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy header map API does not replace all existing occurences of a non-inline header...

Design/Logic Flaw

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy header map API does not replace all existing occurences of a non-inline header...

Design/Logic Flaw

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...

CVE-2020-25018

CVE-2020-25018 concerns Envoy: a vulnerability in the Envoy master between commits 2d69e30 and 3b5acb2 where parsing of URLs requiring host canonicalization may fail. The issue is tied to host normalization during request handling, with multiple connected documents noting exposure leading to an a...

CVE-2020-25018

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization...

CVE-2020-25017

CVE-2020-25017 affects Envoy up to version 1.15.0. The vulnerability arises because when multiple HTTP header values are present, Envoy only considers the first value, and its header map API setCopy() does not replace all existing occurrences of a non-inline header. This behavior is described in ...

CVE-2020-25017

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy header map API does not replace all existing occurences of a non-inline header...

CVE-2020-25018

A flaw was found in envoy. An attacker can craft an HTTP request, which uses an Internationalized Domain Name IDN as the host component, resulting in an attempt to convert the host name from Unicode to ASCII potentially causing a segfault. The highest threat from this vulnerability is to system...

envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests

An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. Envoy then forwards all of the headers as valid to the upstream component. This issue allows an attacker to subvert any...

CVE-2020-25017

An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. Envoy then forwards all of the headers as valid to the upstream component. This issue allows an attacker to subvert any...

RHEL 8 : Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy (RHSA-2020:4129)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4129 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift...