CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29226 – Trivial authentication bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-29226
09 Jun 2022 — Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 • CWE-303: Incorrect Implementation of Authentication Algorithm CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29228 – Reachable assertion in Envoy
https://notcve.org/view.php?id=CVE-2022-29228
09 Jun 2022 — Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions. continueDecoding() shouldn’t ever be called from filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue. Envoy es un proxy de alto rendimiento nativo de la nube. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 • CWE-416: Use After Free CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29225 – Zip bomb vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2022-29225
09 Jun 2022 — Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343 • CWE-400: Uncontrolled Resource Consumption CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29224 – Segmentation fault leading to crash in Envoy
https://notcve.org/view.php?id=CVE-2022-29224
09 Jun 2022 — Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. • https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db • CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43826 – Crash when tunneling TCP over HTTP in Envoy
https://notcve.org/view.php?id=CVE-2021-43826
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43825 – Use-after-free in Envoy
https://notcve.org/view.php?id=CVE-2021-43825
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memor... • https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-21655 – Incorrect handling of internal redirects results in crash in Envoy
https://notcve.org/view.php?id=CVE-2022-21655
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682 • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-21654 – Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
https://notcve.org/view.php?id=CVE-2022-21654
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353 • CWE-295: Improper Certificate Validation CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-21657 – X.509 Extended Key Usage and Trust Purposes bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-21657
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepte... • https://github.com/envoyproxy/envoy/pull/630 • CWE-295: Improper Certificate Validation •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21656 – X.509 subjectAltName matching bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-21656
22 Feb 2022 — Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibi... • https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e • CWE-295: Improper Certificate Validation CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •