CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29228 – Reachable assertion in Envoy
https://notcve.org/view.php?id=CVE-2022-29228
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions. continueDecoding() shouldn’t ever be called from filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue. Envoy es un proxy de alto rendimiento nativo de la nube. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 https://github.com/envoyproxy/envoy/security/advisories/GHSA-rww6-8h7g-8jf6 https://access.redhat.com/security/cve/CVE-2022-29228 https://bugzilla.redhat.com/show_bug.cgi?id=2088740 • CWE-416: Use After Free CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29225 – Zip bomb vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2022-29225
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343 https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh https://access.redhat.com/security/cve/CVE-2022-29225 https://bugzilla.redhat.com/show_bug.cgi?id=2088737 • CWE-400: Uncontrolled Resource Consumption CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29224 – Segmentation fault leading to crash in Envoy
https://notcve.org/view.php?id=CVE-2022-29224
Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. • https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db https://github.com/envoyproxy/envoy/security/advisories/GHSA-m4j9-86g3-8f49 https://access.redhat.com/security/cve/CVE-2022-29224 https://bugzilla.redhat.com/show_bug.cgi?id=2088738 • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43826 – Crash when tunneling TCP over HTTP in Envoy
https://notcve.org/view.php?id=CVE-2021-43826
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145 https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf https://access.redhat.com/security/cve/CVE-2021-43826 https://bugzilla.redhat.com/show_bug.cgi?id=2050748 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43825 – Use-after-free in Envoy
https://notcve.org/view.php?id=CVE-2021-43825
Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service. • https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136 https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh https://access.redhat.com/security/cve/CVE-2021-43825 https://bugzilla.redhat.com/show_bug.cgi?id=2050746 • CWE-416: Use After Free •