CVE-2020-8659: Allocation of Resources Without Limits or Throttling

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small i.e. 1 byte chunks...

Envoy Data Forgery Issue Vulnerability

Envoy is an open source distributed proxy server . A security vulnerability exists in Envoy 1.13.0 and earlier versions. An attacker can exploit this vulnerability by sending specially crafted packets over the TLS protocol to bypass security restrictions...

CVE-2020-8661: Uncontrolled Resource Consumption

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests...

PT-2020-5132 · Cncf · Envoy

Name of the Vulnerable Software and Affected Versions: CNCF Envoy versions 1.13.0 and earlier Description: The issue is related to excessive memory consumption when proxying HTTP/1.1 requests or responses with many small chunks. This can be exploited by a remote attacker to cause a denial of...

CVE-2020-8660: Insufficient Verification of Data Authenticity

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed not recognized as a TLS client by a client using only TLS 1.3. Because TLS extensions SNI, ALPN were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some...

CVE-2020-8664: Improper Authentication

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret e.g. trusted CA across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even thoug...

CVE-2020-8664

An access control bypass vulnerability was found in envoy. When the same TLS secret is used across multiple resources, the client's data, such as the subject alternative name or hash, is not validated. This flaw could lead to a possible bypass of security restrictions...

CVE-2020-8659

A resource consumption vulnerability was found in the servicemesh-proxy in Envoy. An attacker could send specially crafted small HTTP/1.1 packets that, when processed, could cause excessive amounts of memory to be used, possibly degrading or crashing the application...

CVE-2020-8661

A resource consumption vulnerability was found in the servicemesh-proxy in Envoy. An attacker could use pipelined requests to cause excessive amounts of memory to be used, possibly degrading or crashing the application...

CVE-2020-8660

An access control bypass vulnerability was found in envoy. An attacker could send specially crafted packets over TLS v1.3 to possibly bypass security restrictions...

Photon OS 1.0: Envoy PHSA-2020-1.0-0281

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-1.0-0281. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid134206...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-1.0-0281

An update of 'unzip', 'envoy', 'ncurses' packages of Photon OS has been released...

envoy:stat_merger_fuzz_test: Crash in Envoy::Stats::SymbolTableImpl::Encoding::decodeTokens

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5713856297172992 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: statmergerfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00000ac3b000 Cra...

envoy:stat_merger_fuzz_test: Crash in std::__1::iterator_traits<char const*>::difference_type std::__1::count<char con

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5716755467206656 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: statmergerfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000009af9000 Cra...

envoy:stat_merger_fuzz_test: Heap-buffer-overflow in Envoy::Stats::SymbolTableImpl::Encoding::decodeNumber

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5690814401609728 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: statmergerfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

Photon OS 2.0: Envoy PHSA-2020-2.0-0207

An update of the envoy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2020-2.0-0207. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid133687...

Critical Photon OS Security Update - PHSA-2020-0207

Updates of 'envoy', 'ansible', 'libarchive', 'nginx' packages of Photon OS have been released...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2020-2.0-0207

An update of 'envoy', 'nginx', 'libarchive', 'ansible' packages of Photon OS has been released...

envoy:server_fuzz_test: Bad-cast to Envoy::Network::ActiveDnsQuery from invalid vptr in Envoy::Upstream::StrictDnsClusterImpl::ResolveTarget::~ResolveTarget

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5157098222780416 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: serverfuzztest Job Type: libfuzzerubsanenvoy Platform Id: linux Crash Type: Bad-cast Crash Address: 0x0000128fb670 Crash State...

envoy:server_fuzz_test: Heap-use-after-free in Envoy::Upstream::StrictDnsClusterImpl::ResolveTarget::~ResolveTarget

Project: https://github.com/envoyproxy/envoy.git Detailed Report: https://oss-fuzz.com/testcase?key=5143265307525120 Project: envoy Fuzzing Engine: libFuzzer Fuzz Target: serverfuzztest Job Type: libfuzzerasanenvoy Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...