CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-21655 – Incorrect handling of internal redirects results in crash in Envoy
https://notcve.org/view.php?id=CVE-2022-21655
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682 https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg https://access.redhat.com/security/cve/CVE-2022-21655 https://bugzilla.redhat.com/show_bug.cgi?id=2050757 • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-21654 – Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
https://notcve.org/view.php?id=CVE-2022-21654
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade. Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. • https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353 https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283 https://access.redhat.com/security/cve/CVE-2022-21654 https://bugzilla.redhat.com/show_bug.cgi?id=2050753 • CWE-295: Improper Certificate Validation CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-21657 – X.509 Extended Key Usage and Trust Purposes bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-21657
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. • https://github.com/envoyproxy/envoy/pull/630 https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g • CWE-295: Improper Certificate Validation •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21656 – X.509 subjectAltName matching bypass in Envoy
https://notcve.org/view.php?id=CVE-2022-21656
Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted. • https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2 • CWE-295: Improper Certificate Validation CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-23606 – Crash when a cluster is deleted in Envoy
https://notcve.org/view.php?id=CVE-2022-23606
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade. • https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31 https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf https://access.redhat.com/security/cve/CVE-2022-23606 https://bugzilla.redhat.com/show_bug.cgi?id=2050758 • CWE-674: Uncontrolled Recursion CWE-770: Allocation of Resources Without Limits or Throttling •