CVSS: 8.2EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21378 – JWT authentication bypass with unknown issuer token
https://notcve.org/view.php?id=CVE-2021-21378
Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the `allow_missing` requirement under `requires_any` due to a mistake in implementation. Envoy's JWT Authentication filter can be configured with the `allow_missing` requirement that will be satisfied if JWT is missing (JwtMissed error) and fail if JWT is presented or invalid. Due to a mistake in implementation, a JwtUnknownIssuer error was mistakenly converted to JwtMissed when `requires_any` was configured. So if `allow_missing` was configured under `requires_any`, an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list. • https://github.com/envoyproxy/envoy/commit/ea39e3cba652bcc4b11bb0d5c62b017e584d2e5a https://github.com/envoyproxy/envoy/pull/15194 https://github.com/envoyproxy/envoy/security/advisories/GHSA-4996-m8hf-hj27 • CWE-287: Improper Authentication CWE-303: Incorrect Implementation of Authentication Algorithm •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-35470
https://notcve.org/view.php?id=CVE-2020-35470
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters). Envoy versiones anteriores a 1.16.1, registra una dirección posterior incorrecta porque considera solo al peer conectado directamente, no la información en el encabezado proxy protocol. Esto afecta situaciones con tcp-proxy como filtro de red (no filtros HTTP) • https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 https://github.com/envoyproxy/envoy/issues/14087 https://github.com/envoyproxy/envoy/pull/14131 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35471
https://notcve.org/view.php?id=CVE-2020-35471
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500. Envoy versiones anteriores a 1.16.1, maneja inapropiadamente datagramas perdidos y truncados, como es demostrado por un fallo de segmentación para un tamaño de paquete UDP más largo que 1500 • https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 https://github.com/envoyproxy/envoy/issues/14113 https://github.com/envoyproxy/envoy/pull/14122 •
CVSS: 8.3EPSS: 0%CPEs: 4EXPL: 1CVE-2020-25017 – envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests
https://notcve.org/view.php?id=CVE-2020-25017
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header. Envoy versiones hasta 1.15.0, solo considera el primer valor cuando múltiples valores de encabezado están presentes para algunos encabezados HTTP. La API de mapa de encabezado de la función setCopy() de Envoy no reemplaza todas las ocurrencias existentes de un encabezado no en línea An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w https://groups.google.com/forum/#%21forum/envoy-security-announce https://access.redhat.com/security/cve/CVE-2020-25017 https://bugzilla.redhat.com/show_bug.cgi?id=1877613 • CWE-284: Improper Access Control •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15104 – TLS Validation Vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2020-15104
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg https://access.redhat.com/security/cve/CVE-2020-15104 https://bugzilla.redhat.com/show_bug.cgi?id=1856232 • CWE-297: Improper Validation of Certificate with Host Mismatch CWE-346: Origin Validation Error •