CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15104 – TLS Validation Vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2020-15104
14 Jul 2020 — In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only a... • https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg • CWE-297: Improper Validation of Certificate with Host Mismatch CWE-346: Origin Validation Error •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12605 – envoy: Resource exhaustion when processing HTTP/1.1 headers with long field names
https://notcve.org/view.php?id=CVE-2020-12605
01 Jul 2020 — Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs. Envoy versiones 1.14.2, 1.13.2, 1.12.4 o anteriores, puede consumir cantidades excesivas de memoria cuando se procesan encabezados HTTP/1.1 con nombres de campo largos o peticiones con las URL largas An uncontrolled resource consumption vulnerability was found in Envoy. This flaw allows an attacker to craft many HTTP requests with long fie... • https://github.com/envoyproxy/envoy-setec/issues/137 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12604 – envoy: Resource exhaustion via HTTP/2 client requests with large payloads and improper stream windows
https://notcve.org/view.php?id=CVE-2020-12604
01 Jul 2020 — Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream. Envoy versiones 1.14.2, 1.13.2, 1.12.4 o anteriores, es susceptible a incrementar un uso de memoria en el caso en que un cliente HTTP/2 solicita una gran carga útil pero no envía suficientes actualizaciones de ventana para consumir toda la transmisión de datos y ... • https://github.com/envoyproxy/envoy/commits/master • CWE-400: Uncontrolled Resource Consumption CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8663 – envoy: Resource exhaustion when accepting too many connections
https://notcve.org/view.php?id=CVE-2020-8663
01 Jul 2020 — Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. Envoy versión 1.14.2, 1.13.2, 1.12.4 o anteriores, puede agotar los descriptores de archivo y/o memoria al aceptar demasiadas conexiones A flaw was found in envoy in versions through 1.14.1. Accepting too many connections may lead to an exhaustion of file descriptors and/or memory. The highest threat from this vulnerability is to system availability. Red Hat OpenShift Service Mesh ... • https://github.com/envoyproxy/envoy/security/advisories/GHSA-v8q7-fq78-4997 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12603 – envoy: Resource exhaustion when proxying HTTP/2 requests or responses with small data frames
https://notcve.org/view.php?id=CVE-2020-12603
01 Jul 2020 — Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames. Envoy versiones 1.14.2, 1.13.2, 1.12.4 o anteriores, puede consumir cantidades excesivas de memoria al hacer proxy de peticiones o respuestas HTTP/2 con muchas tramas de datos pequeños (es decir, 1 byte) A flaw was found in Envoy in versions through 1.14.1. An excessive amount of memory may be consumed when proxying HTTP/2 requests and ... • https://github.com/envoyproxy/envoy-setec/issues/80 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 3.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-11767
https://notcve.org/view.php?id=CVE-2020-11767
15 Apr 2020 — Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request for a domain concurrently configured explicitly (e.g., abc.example.com) is sent to the server(s) listening behind *.example.com. The outcome should instead be 421 Misdirected Request. Imagine a shared caching forward proxy re-using an HTTP/2 connection for a large subnet with many users. If a victim is interacting with abc.example.com, and a server (f... • https://bugs.chromium.org/p/chromium/issues/detail?id=954160#c5 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8660 – envoy: TLS inspector bypassc
https://notcve.org/view.php?id=CVE-2020-8660
04 Mar 2020 — CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process. Una omisión del inspector TLS de CNCF Envoy versiones hasta 1.13.0. El inspector TLS podría haber sido omitido (no reconocido como cliente TLS) por un cliente que usa solo TLS ... • https://access.redhat.com/errata/RHSA-2020:0734 • CWE-345: Insufficient Verification of Data Authenticity CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-18802 – envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure
https://notcve.org/view.php?id=CVE-2019-18802
12 Dec 2019 — An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers. Se detectó un problema en Envoy versión 1.12.0. Un cliente remoto no confiable puede enviar un encabezado HTTP (como Host) con espacios en blanco después del contenido del encabezado. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.html • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-18838 – envoy: malformed HTTP request without the Host header may cause abnormal termination of the Envoy process
https://notcve.org/view.php?id=CVE-2019-18838
12 Dec 2019 — An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL pointer dereference, resulting in abnormal termination of the Envoy process. Se detectó un problema en Envoy versión 1.1... • https://blog.envoyproxy.io • CWE-358: Improperly Implemented Security Check for Standard CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-18801 – envoy: an untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1
https://notcve.org/view.php?id=CVE-2019-18801
12 Dec 2019 — An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1. This may be used to corrupt nearby heap contents (leading to a query-of-death scenario) or may be used to bypass Envoy's access control mechanisms such as path based routing. An attacker can also modify requests from other users that happen to be proximal temporally and spatially. Se detectó un problema en Envoy versión 1.12.0. • https://access.redhat.com/errata/RHSA-2019:4222 • CWE-131: Incorrect Calculation of Buffer Size CWE-787: Out-of-bounds Write •