CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

envoy:codec_impl_fuzz_test: Null-dereference READ with empty stacktrace

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5176497475420160 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Null-dereference READ Crash Address:...

The vulnerability of the network programming environments Envoy and Istio lies in their susceptibility to entering an infinite loop when processing certain input data. This allows attackers to cause service failures.

The vulnerability of the network programming environments Envoy and Istio is related to the entry into an infinite loop when certain input data is provided. Exploiting this vulnerability can allow a attacker to cause service failures...

envoy:codec_impl_fuzz_test: Stack-use-after-scope in Envoy::Http::Http1::ConnectionImpl::readDisable

Detailed Report: https://oss-fuzz.com/testcase?key=5716313302630400 Project: envoy Fuzzing Engine: afl Fuzz Target: codecimplfuzztest Job Type: aflasanenvoy Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address: 0x7f5c31653660 Crash State:...

Regular Expression Denial Of Service (ReDoS)

envoy is vulnerable to regular expression denial of service. A remote attacker is able to cause a denial of service from excessive memory usage via a very long URI...

istio/envoy: crafted packet allows remote attacker to cause denial of service

A null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 not on by default in version 1.4.x, an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service...

envoy:codec_impl_fuzz_test: Bad-cast to testing::internal::FunctionMocker<Envoy::Network::Connection::State ()> from testing::internal::UntypedFunctionMockerBase in Envoy::Network::MockConnection::state

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5653835151572992 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffe11206980 Crash...

envoy:conn_manager_impl_fuzz_test: Heap-buffer-overflow in Envoy::Fuzz::replaceInvalidHostCharacters

Detailed Report: https://oss-fuzz.com/testcase?key=5630167902060544 Project: envoy Fuzzing Engine: afl Fuzz Target: connmanagerimplfuzztest Job Type: aflasanenvoy Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6240000e1de0 Crash State:...

Cloud Lookup (and Bypass)

This module can be useful if you need to test the security of your server and your website behind a solution Cloud based. By discovering the origin IP address of the targeted host. More precisely, this module uses multiple data sources in order ViewDNS.info, DNS enumeration and Censys to collect...

envoy:codec_impl_fuzz_test: Crash in Envoy::Http::HttpStream::directionalAction

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5766628005642240 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6190017d3f48 Crash...

envoy:codec_impl_fuzz_test: Stack-use-after-scope in Envoy::Http::Http1::ConnectionImpl::readDisable

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5664448854622208 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: codecimplfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address:...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0290

An update of 'openjdk', 'linux', 'openjdk11', 'envoy', 'linux-esx', 'httpd', 'PyYAML', 'systemd' packages of Photon OS has been released...

Photon OS 2.0: Envoy PHSA-2020-2.0-0229

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0229. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135867...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

Design/Logic Flaw

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

CVE-2020-11767

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection negotiated with SNI over HTTPS to .example.com, a request for a domain concurrently configured explicitly e.g., abc.example.com is sent to the servers listening behind .example.com. The outcome shoul...

CVE-2020-11767

Istio up to 1.5.1 and Envoy up to 1.14.1 are affected by a data-leak vulnerability where a TCP connection negotiated with SNI over HTTPS to *.example.com can cause a domain-specific request (e.g., abc.example.com) to be sent via a connection reused by a forward proxy to the *.example.com host. Th...

Photon OS 1.0: Envoy PHSA-2020-1.0-0286

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0286. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid135494...

Envoy and Istio Information Disclosure Vulnerabilities

Envoy is an open source distributed proxy server.Istio is an open platform for connecting, managing and securing microservices. An information disclosure vulnerability exists in Istio 1.5.1 and earlier versions and Envoy 1.14.1 and earlier versions. An attacker can exploit the vulnerability to...