Photon OS 2.0: Envoy PHSA-2020-2.0-0285

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0285. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid140713...

envoy:h2_capture_fuzz_test: Heap-use-after-free in Envoy::Http::ResponseDecoderWrapper::decodeMetadata

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=6214466168160256 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: h2capturefuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

envoy:server_fuzz_test: Heap-use-after-free in Envoy::Http::AsyncStreamImpl::resetStream

Detailed Report: https://oss-fuzz.com/testcase?key=5539928229019648 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: serverfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6120000e2cc8 Crash State:...

envoy:network_readfilter_fuzz_test: Heap-use-after-free in absl::container_internal::raw_hash_set<absl::container_internal::FlatHashMapPoli

Detailed Report: https://oss-fuzz.com/testcase?key=5658880747765760 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: networkreadfilterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x6130000f34f0 Crash State:...

envoy:network_writefilter_fuzz_test: Heap-buffer-overflow in std::__1::char_traits<char>::length

Detailed Report: https://oss-fuzz.com/testcase?key=4685640437071872 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: networkwritefilterfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x621000b0c900 Crash State:...

istio: incorrect translation of DENY policy for TCP service

An insecure access control vulnerability was found in Istio. If an authorization policy is created for a TCP service that includes a DENY rule with a prefix wildcard, Istio translates this into an Envoy string match, incorrectly removing the wildcard. This flaw allows an attacker to subvert...

CVE-2020-16844

An insecure access control vulnerability was found in Istio. If an authorization policy is created for a TCP service that includes a DENY rule with a prefix wildcard, Istio translates this into an Envoy string match, incorrectly removing the wildcard. This flaw allows an attacker to subvert...

Denial Of Service (DoS)

github.com/projectcontour/contour is vulnerable to denial of service DoS. The vulnerability exists as there is a lack of authentication to perform GET requests to the unsafe /shutdown endpoint on port 8090, allowing an attacke rto remove Envoy from the routing pool...

Contour Access Control Error Vulnerability

Contour is a Kubernetes entry controller that uses the Envoy agent. An Access Control Error vulnerability exists in versions prior to Contour 1.7.0. The vulnerability stems from a network system or product not properly restricting access to resources from unauthorized roles. No detailed...

CVE-2020-15127

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...

CVE-2020-15127

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...

Code injection

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...

CVE-2020-15127

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...

CVE-2020-15127 Denial of service in Contour

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...

CVE-2020-15127

Contour (Ingress controller for Kubernetes) prior to version 1.7.0 is affected by a DoS that lets a network attacker shut down all Envoy instances. The vulnerability arises from an unauthenticated /shutdown endpoint on port 8090 of the Envoy pod, which triggers Envoy shutdown and flips the readin...

PT-2020-14207 · Lyft +1 · Envoy +1

Content removed...

Photon OS 2.0: Envoy PHSA-2020-2.0-0265

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0265. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139053...

Photon OS 1.0: Envoy PHSA-2020-1.0-0309

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0309. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid139048...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0265

An update of 'mysql', 'python2', 'envoy', 'apache-tomcat', 'openjdk8', 'openjdk11', 'python3' packages of Photon OS has been released...

envoy:xds_fuzz_test: Heap-use-after-free in std::__1::__list_iterator<std::__1::unique_ptr<Envoy::Server::ListenerImpl, std:

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5715241737125888 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: xdsfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x603000f1b6...