CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2021-28682 – envoyproxy/envoy: integer overflow handling large grpc-timeouts
https://notcve.org/view.php?id=CVE-2021-28682
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations. Se detectó un problema en Envoy versiones hasta 1.71.1. presenta un desbordamiento de enteros explotable remoto en el que un valor de grpc-timeout muy grande conlleva a cálculos de tiempo de espera inesperados A flaw was found in envoyproxy/envoy. An attacker, able to craft a packet which specifies a large grpc-timeout, can potentially cause envoy to incorrectly calculate the timeouts resulting in a denial of service. • https://blog.envoyproxy.io https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36 https://github.com/envoyproxy/envoy/releases https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg https://access.redhat.com/security/cve/CVE-2021-28682 https://bugzilla.redhat.com/show_bug.cgi?id=1942272 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29258 – envoyproxy/envoy: crash with empty HTTP/2 metadata map
https://notcve.org/view.php?id=CVE-2021-29258
An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion. Se detectó un problema en Envoy versión 1.14.0. Se presenta un bloqueo explotable remoto para unos metadatos HTTP2, porque un mapa de METADATOS vacío desencadena un Reachable Assertion A flaw was found in envoyproxy. An attacker, able to craft an HTTP2 request that specifies an empty metadata map, can crash envoy resulting in a denial of service due to the null reference. • https://blog.envoyproxy.io https://github.com/envoyproxy/envoy-setec/pull/230 https://github.com/envoyproxy/envoy/releases/tag/v1.14.0 https://github.com/envoyproxy/envoy/security/advisories/GHSA-rqvq-hxw5-776j https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg https://access.redhat.com/security/cve/CVE-2021-29258 https://bugzilla.redhat.com/show_bug.cgi?id=1942280 • CWE-476: NULL Pointer Dereference CWE-617: Reachable Assertion •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35470
https://notcve.org/view.php?id=CVE-2020-35470
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters). Envoy versiones anteriores a 1.16.1, registra una dirección posterior incorrecta porque considera solo al peer conectado directamente, no la información en el encabezado proxy protocol. Esto afecta situaciones con tcp-proxy como filtro de red (no filtros HTTP) • https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 https://github.com/envoyproxy/envoy/issues/14087 https://github.com/envoyproxy/envoy/pull/14131 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35471
https://notcve.org/view.php?id=CVE-2020-35471
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500. Envoy versiones anteriores a 1.16.1, maneja inapropiadamente datagramas perdidos y truncados, como es demostrado por un fallo de segmentación para un tamaño de paquete UDP más largo que 1500 • https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 https://github.com/envoyproxy/envoy/issues/14113 https://github.com/envoyproxy/envoy/pull/14122 •