CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29226 – Trivial authentication bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-29226
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh https://access.redhat.com/security/cve/CVE-2022-29226 https://bugzilla.redhat.com/show_bug.cgi?id=2088739 • CWE-303: Incorrect Implementation of Authentication Algorithm CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29228 – Reachable assertion in Envoy
https://notcve.org/view.php?id=CVE-2022-29228
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions. continueDecoding() shouldn’t ever be called from filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue. Envoy es un proxy de alto rendimiento nativo de la nube. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 https://github.com/envoyproxy/envoy/security/advisories/GHSA-rww6-8h7g-8jf6 https://access.redhat.com/security/cve/CVE-2022-29228 https://bugzilla.redhat.com/show_bug.cgi?id=2088740 • CWE-416: Use After Free CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29225 – Zip bomb vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2022-29225
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343 https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh https://access.redhat.com/security/cve/CVE-2022-29225 https://bugzilla.redhat.com/show_bug.cgi?id=2088737 • CWE-400: Uncontrolled Resource Consumption CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29224 – Segmentation fault leading to crash in Envoy
https://notcve.org/view.php?id=CVE-2022-29224
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. • https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db https://github.com/envoyproxy/envoy/security/advisories/GHSA-m4j9-86g3-8f49 https://access.redhat.com/security/cve/CVE-2022-29224 https://bugzilla.redhat.com/show_bug.cgi?id=2088738 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43826 – Crash when tunneling TCP over HTTP in Envoy
https://notcve.org/view.php?id=CVE-2021-43826
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145 https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf https://access.redhat.com/security/cve/CVE-2021-43826 https://bugzilla.redhat.com/show_bug.cgi?id=2050748 • CWE-416: Use After Free •