Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 198

Export CSV
CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf and 13 more
CVE-2022-27664

golang: net/http: handle server errors after sending GOAWAY

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Acm and 16 more
CVE-2022-25858

Regular Expression Denial of Service (ReDoS)

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

CVSS 3.1 · 5.3 Medium EPSS 3.3% KEV · Not listed
Vendors
Redhat Terser
Products
Acm Service Mesh Service Registry and 1 more
CVE-2022-24921

golang: regexp: stack exhaustion via a deeply nested expression

regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Astra Trident and 8 more
CVE-2022-23806

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

CVSS 3.1 · 9.1 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Beegfs Csi Driver and 11 more
CVE-2022-23773

golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Beegfs Csi Driver Cloud Insights Telegraf Agent and 9 more
CVE-2022-23772

golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Beegfs Csi Driver and 10 more
CVE-2021-43565

golang.org/x/crypto: empty plaintext packet causes panic

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Golang Redhat
Products
Ssh Acm Advanced Cluster Security and 6 more
CVE-2021-43138

async: Prototype Pollution in async

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

CVSS 3.1 · 7.8 High EPSS 3.3% KEV · Not listed
Vendors
Async Project Fedoraproject Redhat
Products
Async Fedora Rhmt and 1 more
CVE-2021-3749

Inefficient Regular Expression Complexity in axios/axios

axios is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1 · 7.5 High EPSS 8.5% KEV · Not listed
Vendors
Axios Oracle Redhat and 1 more
Products
Axios Goldengate Acm and 6 more
CVE-2021-3586

servicemesh-operator: NetworkPolicy resources incorrectly specify ports for ingress resources

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Openshift Service Mesh Service Mesh Servicemesh-operator
CVE-2021-3495

kiali/kiali-operator: can deploy specified image to any namespace

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Netlify Redhat
Products
Kiali-operator Openshift Service Mesh Service Mesh
CVE-2021-3121

gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS 3.1 · 8.6 High EPSS 3.4% KEV · Not listed
Vendors
Golang Hashicorp Redhat
Products
Protobuf Consul Acm and 6 more
CVE-2021-39156

Fragments in Path May Lead to Authorization Policy Bypass

Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Service Mesh
CVE-2021-39155

Authorization Policy Bypass Due to Case Insensitive Host Comparison

Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed. As an example, the user may have an authorization policy that rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by sending the request with hostname "Httpbin.Foo". Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize Host header before the authorization check. This is similar to the Path normalization presented in the [Security Best Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.

CVSS 3.1 · 8.3 High EPSS 1.2% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Service Mesh
CVE-2021-36221

golang: net/http/httputil: panic due to racy read of persistConn after handler panic

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS 3.1 · 5.9 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 3 more
Products
Debian Linux Fedora Go and 12 more
CVE-2021-32781

Continued processing of requests after locally generated response

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when local response is generated due the internal buffer overflow while request or response is processed by the filter chain the operation may not be stopped completely and result in accessing a freed memory block. A specifically constructed request delivered by an untrusted downstream or upstream peer in the presence of extensions that modify and increase the size of request or response bodies resulting in a Denial of Service when using extensions that modify and increase the size of request or response bodies, such as decompressor filter. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to address incomplete termination of request processing after locally generated response. As a workaround disable Envoy's decompressor, json-transcoder or grpc-web extensions or proprietary extensions that modify and increase the size of request or response bodies, if feasible.

CVSS 3.1 · 8.6 High EPSS 1.3% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-32779

Incorrectly handling of URI '#fragment' element as part of the path element

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for authorization or similar mechanism with an explicit case of a final "/admin" path element, or is using a negative assertion with final path element of "/admin". The client sends request to "/app1/admin#foo". In Envoy prior to 1.18.0, or 1.18.0+ configured with path_normalization=false. Envoy treats fragment as a suffix of the query string when present, or as a suffix of the path when query string is absent, so it evaluates the final path element as "/admin#foo" and mismatches with the configured "/admin" path element. In Envoy 1.18.0+ configured with path_normalization=true. Envoy transforms this to /app1/admin%23foo and mismatches with the configured /admin prefix. The resulting URI is sent to the next server-agent with the offending "#foo" fragment which violates RFC3986 or with the nonsensical "%23foo" text appended. A specifically constructed request with URI containing '#fragment' element delivered by an untrusted client in the presence of path based request authorization resulting in escalation of Privileges when path based request authorization extensions. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes that removes fragment from URI path in incoming requests.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-32778

Excessive CPU utilization when closing HTTP/2 streams

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.

CVSS 3.1 · 5.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh