envoy:config_fuzz_test: Heap-use-after-free in Envoy::Upstream::ZoneAwareLoadBalancerBase::~ZoneAwareLoadBalancerBase

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=6136135336329216 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: configfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

Wallarm Launches Support of Envoy Proxy/ Envoy API Protection

Wallarm can protect North-South API in the applications that use Envoy as an alternative Ingress controller at the front end of a Kubernetes cluster. Wallarm can also protect edge traffic and also East-West Envoy API for Service-Mesh and Istio. The post Wallarm Launches Support of Envoy Proxy/...

Envoy Denial of Service Vulnerability

Envoy is an open source distributed proxy server . Envoy has a denial of service vulnerability that can be exploited by remote attackers to cause a denial of service...

CVE-2019-18817

A flaw was found in envoy. When the option continueonlistenerfilterstimeout is set to True, an infinite loop can be triggered that could effectively exhaust Envoy's CPU resources causing a denial of service. The highest threat from this vulnerability is to system availability...

CVE-2019-18836

A flaw was found in envoy. When listeners are configured with continueonlistenerfilterstimeout true, an infinite busy loop is created if at least one connection is maintained on the loop. A remote attacker only needs to maintain one idle connection to consume one CPU core of the Envoy server,...

CVE-2019-18836

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continueonlistenerfilterstimeout is used."...

CVE-2019-18836

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continueonlistenerfilterstimeout is used."...

Design/Logic Flaw

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continueonlistenerfilterstimeout is used."...

CVE-2019-18836

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continueonlistenerfilterstimeout is used."...

CVE-2019-18836

CVE-2019-18836 is linked to a DoS in Envoy where a single idle TCP connection can keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used. Connected documents tie this to Istio 1.3.x before 1.3.5 (continue_on_listener_filters_timeout set to True), identifyi...

Envoy CVE-2019-18836 Remote Denial of Service Vulnerability

Description Envoy is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause denial of service conditions. Technologies Affected Envoy Envoy 1.12.0 Istio Istio 1.3.0 Istio Istio 1.3.1 Istio Istio 1.3.2 Istio Istio 1.3.3 Recommendations Block external access ...

Node.js: HTTP header values do not have trailing OWS trimmed

I suspect I may have tagged the wrong vulnerability type -I'm failing to find "insufficient validation of user input" According to the HTTP-spec, http values are field-value = field-content | LWS httpparser does not appear to trim trailing LWS. This means if a user sends "Host: foo\r\n" the strin...

CVE-2019-15225

A flaw was found in Envoy through version 1.11.1. Users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service through memory consumption. The highest thre...

envoy:compressor_fuzz_test: Index-out-of-bounds in compress_block

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5149986500640768 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: compressorfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State...

envoy:server_fuzz_test: Heap-use-after-free in Envoy::Config::DeltaSubscriptionState::getNextRequestAckless

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5707079628619776 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: serverfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

CVE-2019-15226

Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had...

CVE-2019-9900

A flaw was found in Envoy version 1.9.0 and older, where Envoy does not reject embedded zero characters NUL, ASCII 0x0 when processing HTTP/1.x header values. This flaw allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules,...

CVE-2019-15226

Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had...

CVE-2019-15226

Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had...

Server side request forgery (ssrf)

Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had...