CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8661 – envoy: Response flooding for HTTP/1.1
https://notcve.org/view.php?id=CVE-2020-8661
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests. CNCF Envoy versiones hasta 1.13.0, puede consumir cantidades excesivas de memoria cuando responde internamente a peticiones en tuberías "pipelined". A resource consumption vulnerability was found in the servicemesh-proxy in Envoy. An attacker could use pipelined requests to cause excessive amounts of memory to be used, possibly degrading or crashing the application. • https://access.redhat.com/errata/RHSA-2020:0734 https://github.com/envoyproxy/envoy/security/advisories/GHSA-36cq-ww7h-p4j7 https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history https://access.redhat.com/security/cve/CVE-2020-8661 https://bugzilla.redhat.com/show_bug.cgi?id=1802540 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8659 – envoy: Excessive CPU and/or memory usage when proxying HTTP/1.1
https://notcve.org/view.php?id=CVE-2020-8659
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. CNCF Envoy versiones hasta 1.13.0, puede consumir cantidades excesivas de memoria cuando se hace proxy a peticiones o respuestas HTTP/1.1 con muchos fragmentos pequeños (es decir, 1 byte). A resource consumption vulnerability was found in the servicemesh-proxy in Envoy. An attacker could send specially crafted small HTTP/1.1 packets that, when processed, could cause excessive amounts of memory to be used, possibly degrading or crashing the application. • https://access.redhat.com/errata/RHSA-2020:0734 https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history https://access.redhat.com/security/cve/CVE-2020-8659 https://bugzilla.redhat.com/show_bug.cgi?id=1802539 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2019-9946 – kubernetes: Incorrect rule injection in CNI portmap plugin
https://notcve.org/view.php?id=CVE-2019-9946
Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI 'portmap' plugin, used to setup HostPorts for CNI, inserts rules at the front of the iptables nat chains; which take precedence over the KUBE- SERVICES chain. Because of this, the HostPort/portmap rule could match incoming traffic even if there were better fitting, more specific service definition rules like NodePorts later in the chain. The issue is fixed in CNI 0.7.5 and Kubernetes 1.11.9, 1.12.7, 1.13.5, and 1.14.0. La interfaz de red del contenedor (CNI) de Cloud Native Computing Foundation (CNCF), en su versión 0.7.4, tiene una configuración incorrecta en el firewall de red que afecta a Kubernetes. • https://access.redhat.com/errata/RHBA-2019:0862 https://github.com/containernetworking/plugins/pull/269#issuecomment-477683272 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCN66VYB3XS76SYH567SO7N3I254JOCT https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGOOWAELGH3F7OXRBPH3HCNZELNLXYTW https://security.netapp.com/advisory/ntap-20190416-0002 https://access.redhat.com/security/cve/CVE-2019-9946 https://bugzilla.redhat.com/show_bug.cgi?id& • CWE-670: Always-Incorrect Control Flow Implementation CWE-841: Improper Enforcement of Behavioral Workflow •