CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-43824 – Null pointer dereference in envoy
https://notcve.org/view.php?id=CVE-2021-43824
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p https://access.redhat.com/security/cve/CVE-2021-43824 https://bugzilla.redhat.com/show_bug.cgi?id=2050744 • CWE-476: NULL Pointer Dereference •
CVSS: 8.6EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39206 – Incorrect Authorization with specially crafted requests
https://notcve.org/view.php?id=CVE-2021-39206
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, contains two authorization related vulnerabilities CVE-2021-32777 and CVE-2021-32779. This may lead to incorrect routing or authorization policy decisions. With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium. Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9 https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fm https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ • CWE-863: Incorrect Authorization •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2021-39204 – Excessive CPU usage in Pomerium
https://notcve.org/view.php?id=CVE-2021-39204
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ • CWE-834: Excessive Iteration •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2021-39162 – Incorrect handling of H2 GOAWAY + SETTINGS frames
https://notcve.org/view.php?id=CVE-2021-39162
Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted *upstream* servers. 0.15.1 contains an upgraded envoy binary with this vulnerability patched. If only trusted upstreams are configured, there is not substantial risk of this condition being triggered. Pomerium es un proxy de acceso de código abierto consciente de la identidad. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8 https://github.com/pomerium/pomerium/security/advisories/GHSA-gjcg-vrxg-xmgv https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 8.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29492 – Bypass of path matching rules using escaped slash characters
https://notcve.org/view.php?id=CVE-2021-29492
Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-4987-27fx-x6cf https://access.redhat.com/security/cve/CVE-2021-29492 https://bugzilla.redhat.com/show_bug.cgi?id=1951188 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-863: Incorrect Authorization •