CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 1CVE-2023-27487 – Envoy client may fake the header `x-envoy-original-path`
https://notcve.org/view.php?id=CVE-2023-27487
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header would then be used for trace logs and grpc logs, as well as used in the URL used for `jwt_authn` checks if the `jwt_authn` filter is used, and any other upstream use of the x-envoy-original-path header. Attackers may forge a trusted `x-envoy-original-path` header. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-5375-pq35-hf2g https://access.redhat.com/security/cve/CVE-2023-27487 https://bugzilla.redhat.com/show_bug.cgi?id=2179135 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29227 – Use after free in Envoy
https://notcve.org/view.php?id=CVE-2022-29227
Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6 • CWE-416: Use After Free •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29226 – Trivial authentication bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-29226
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh https://access.redhat.com/security/cve/CVE-2022-29226 https://bugzilla.redhat.com/show_bug.cgi?id=2088739 • CWE-303: Incorrect Implementation of Authentication Algorithm CWE-306: Missing Authentication for Critical Function •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29228 – Reachable assertion in Envoy
https://notcve.org/view.php?id=CVE-2022-29228
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in newer versions and corrupts memory on earlier versions. continueDecoding() shouldn’t ever be called from filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds for this issue. Envoy es un proxy de alto rendimiento nativo de la nube. • https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 https://github.com/envoyproxy/envoy/security/advisories/GHSA-rww6-8h7g-8jf6 https://access.redhat.com/security/cve/CVE-2022-29228 https://bugzilla.redhat.com/show_bug.cgi?id=2088740 • CWE-416: Use After Free CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-29225 – Zip bomb vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2022-29225
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343 https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh https://access.redhat.com/security/cve/CVE-2022-29225 https://bugzilla.redhat.com/show_bug.cgi?id=2088737 • CWE-400: Uncontrolled Resource Consumption CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) •