Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 128

Export CSV
CVE-2021-29492

Bypass of path matching rules using escaped slash characters

Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret `%2F` and `/` and `%5C` and `\` interchangeably are impacted. ### Attack Vector URL paths containing escaped slash characters delivered by untrusted client. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters. As a workaround, if back end servers treat `%2F` and `/` and `%5C` and `\` interchangeably and a URL path based access control is configured, one may reconfigure the back end server to not treat `%2F` and `/` and `%5C` and `\` interchangeably.

CVSS 3.1 · 8.1 High EPSS 63.1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-29258

envoyproxy/envoy: crash with empty HTTP/2 metadata map

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-28683

envoyproxy/envoy: NULL pointer dereference in TLS alert code handling

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-28682

envoyproxy/envoy: integer overflow handling large grpc-timeouts

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-21378

JWT authentication bypass with unknown issuer token

Envoy is a cloud-native high-performance edge/middle/service proxy. In Envoy version 1.17.0 an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list when Envoy's JWT Authentication filter is configured with the `allow_missing` requirement under `requires_any` due to a mistake in implementation. Envoy's JWT Authentication filter can be configured with the `allow_missing` requirement that will be satisfied if JWT is missing (JwtMissed error) and fail if JWT is presented or invalid. Due to a mistake in implementation, a JwtUnknownIssuer error was mistakenly converted to JwtMissed when `requires_any` was configured. So if `allow_missing` was configured under `requires_any`, an attacker can bypass authentication by presenting a JWT token with an issuer that is not in the provider list. Integrity may be impacted depending on configuration if the JWT token is used to protect against writes or modifications. This regression was introduced on 2020/11/12 in PR 13839 which fixed handling `allow_missing` under RequiresAny in a JwtRequirement (see issue 13458). The AnyVerifier aggregates the children verifiers' results into a final status where JwtMissing is the default error. However, a JwtUnknownIssuer was mistakenly treated the same as a JwtMissing error and the resulting final aggregation was the default JwtMissing. As a result, `allow_missing` would allow a JWT token with an unknown issuer status. This is fixed in version 1.17.1 by PR 15194. The fix works by preferring JwtUnknownIssuer over a JwtMissing error, fixing the accidental conversion and bypass with `allow_missing`. A user could detect whether a bypass occurred if they have Envoy logs enabled with debug verbosity. Users can enable component level debug logs for JWT. The JWT filter logs will indicate that there is a request with a JWT token and a failure that the JWT token is missing.

CVSS 3.1 · 8.2 High EPSS 1.7% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2020-8663

envoy: Resource exhaustion when accepting too many connections

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-8660

envoy: TLS inspector bypassc

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-35471

envoy: mishandling dropped and truncated datagrams leads to segfault and DoS

Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2020-35470

envoy: logs incorrect downstream address making it possible to bypass the RBAC policy

Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2020-25018

envoyproxy/envoy: Null pointer deference in URL parsing

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Envoyproxy
Products
Envoy
CVE-2020-25017

envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-15104

TLS Validation Vulnerability in Envoy

In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-12605

envoy: Resource exhaustion when processing HTTP/1.1 headers with long field names

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-12604

envoy: Resource exhaustion via HTTP/2 client requests with large payloads and improper stream windows

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-12603

envoy: Resource exhaustion when proxying HTTP/2 requests or responses with small data frames

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-11767

istio/envoy: forward proxy between the victim and the origin leads to information disclosure

Istio through 1.5.1 and Envoy through 1.14.1 have a data-leak issue. If there is a TCP connection (negotiated with SNI over HTTPS) to *.example.com, a request for a domain concurrently configured explicitly (e.g., abc.example.com) is sent to the server(s) listening behind *.example.com. The outcome should instead be 421 Misdirected Request. Imagine a shared caching forward proxy re-using an HTTP/2 connection for a large subnet with many users. If a victim is interacting with abc.example.com, and a server (for abc.example.com) recycles the TCP connection to the forward proxy, the victim's browser may suddenly start sending sensitive data to a *.example.com server. This occurs because the forward proxy between the victim and the origin server reuses connections (which obeys the specification), but neither Istio nor Envoy corrects this by sending a 421 error. Similarly, this behavior voids the security model browsers have put in place between domains.

CVSS 3.1 · 3.1 Low EPSS 1.8% KEV · Not listed
Vendors
Envoyproxy Istio
Products
Envoy Istio
CVE-2019-9901

istio/envoy: Path traversal via URL Patch manipulation in HTTP/1.x header

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

CVSS 3.0 · 6.5 Medium EPSS 5.0% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2019-9900

istio/envoy: Authorization bypass via null characters injection in HTTP/1.x

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

CVSS 3.1 · 8.3 High EPSS 3.7% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Openshift Service Mesh Service Mesh
CVE-2019-18838

envoy: malformed HTTP request without the Host header may cause abnormal termination of the Envoy process

An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an internally generated "Invalid request" response. This internally generated response is dispatched through the configured encoder filter chain before being sent to the client. An encoder filter that invokes route manager APIs that access a request's Host header causes a NULL pointer dereference, resulting in abnormal termination of the Envoy process.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2019-18836

envoy: excessive iteration due to listener filter timeout leads to DoS

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used."

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Envoyproxy Istio
Products
Envoy Istio