CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43825 – Use-after-free in Envoy
https://notcve.org/view.php?id=CVE-2021-43825
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memor... • https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-21655 – Incorrect handling of internal redirects results in crash in Envoy
https://notcve.org/view.php?id=CVE-2022-21655
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682 • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-21654 – Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
https://notcve.org/view.php?id=CVE-2022-21654
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353 • CWE-295: Improper Certificate Validation CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-21657 – X.509 Extended Key Usage and Trust Purposes bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-21657
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepte... • https://github.com/envoyproxy/envoy/pull/630 • CWE-295: Improper Certificate Validation •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21656 – X.509 subjectAltName matching bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-21656
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibi... • https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e • CWE-295: Improper Certificate Validation CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43824 – Null pointer dereference in envoy
https://notcve.org/view.php?id=CVE-2021-43824
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a • CWE-476: NULL Pointer Dereference •
CVSS: 8.6EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39206 – Incorrect Authorization with specially crafted requests
https://notcve.org/view.php?id=CVE-2021-39206
09 Sep 2021 — Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39204 – Excessive CPU usage in Pomerium
https://notcve.org/view.php?id=CVE-2021-39204
09 Sep 2021 — Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc • CWE-834: Excessive Iteration •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39162 – Incorrect handling of H2 GOAWAY + SETTINGS frames
https://notcve.org/view.php?id=CVE-2021-39162
09 Sep 2021 — Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered. Pomerium es un proxy de acceso de código abierto consciente de la identi... • https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32781 – Continued processing of requests after locally generated response
https://notcve.org/view.php?id=CVE-2021-32781
24 Aug 2021 — Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by... • https://github.com/envoyproxy/envoy/security/advisories/GHSA-5vhv-gp9v-42qv • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-416: Use After Free CWE-476: NULL Pointer Dereference •