Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 198

Export CSV
CVE-2021-32777

Incorrect concatenation of multiple value request headers in ext-authz extension

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization.

CVSS 3.1 · 8.6 High EPSS 3.3% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-32760

Archive package allows chmod of file outside of unpack target directory

containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.

CVSS 3.1 · 5 Medium EPSS 1.6% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Containerd Openstack and 1 more
CVE-2021-31921

istio/istio: authorization bypass when using AUTO_PASSTHROUGH

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Service Mesh
CVE-2021-31920

istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Service Mesh
CVE-2021-29923

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Oracle and 1 more
Products
Fedora Go Timesten In-memory Database and 10 more
CVE-2021-29492

Bypass of path matching rules using escaped slash characters

Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypass access control, e.g. a block on `/admin`. A backend server could then decode slash sequences and normalize path and provide an attacker access beyond the scope provided for by the access control policy. ### Impact Escalation of Privileges when using RBAC or JWT filters with enforcement based on URL path. Users with back end servers that interpret `%2F` and `/` and `%5C` and `\` interchangeably are impacted. ### Attack Vector URL paths containing escaped slash characters delivered by untrusted client. Patches in versions 1.18.3, 1.17.3, 1.16.4, 1.15.5 contain new path normalization option to decode escaped slash characters. As a workaround, if back end servers treat `%2F` and `/` and `%5C` and `\` interchangeably and a URL path based access control is configured, one may reconfigure the back end server to not treat `%2F` and `/` and `%5C` and `\` interchangeably.

CVSS 3.1 · 8.1 High EPSS 63.1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-29482

denial of service in github.com/ulikunitz/xz

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat Xz Project
Products
Acm Container Native Virtualization Openshift Api Data Protection and 3 more
CVE-2021-29258

envoyproxy/envoy: crash with empty HTTP/2 metadata map

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-28683

envoyproxy/envoy: NULL pointer dereference in TLS alert code handling

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-28682

envoyproxy/envoy: integer overflow handling large grpc-timeouts

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2021-20329

Specific cstrings input may not be properly validated in the Go Driver

Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshalling Go objects into BSON. A malicious user could use a Go object with specific string to potentially inject additional fields into marshalled documents. This issue affects all MongoDB GO Drivers prior to and including 1.5.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb Redhat
Products
Go Driver Container Native Virtualization Openshift and 1 more
CVE-2020-9283

golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

CVSS 3.1 · 7.5 High EPSS 21.1% KEV · Not listed
Vendors
Debian Golang Redhat
Products
Debian Linux Package Ssh 3scale Amp and 4 more
CVE-2020-8663

envoy: Resource exhaustion when accepting too many connections

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-8660

envoy: TLS inspector bypassc

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-8595

istio: unauthorised access to JWT protected HTTP path

Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.

CVSS 3.1 · 7.3 High EPSS 2.6% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Enterprise Linux Openshift Service Mesh and 1 more
CVE-2020-8124

npmjs-url-parse: Improper validation of protocol of the returned URL

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat Url-parse Project
Products
Service Mesh Url-parse
CVE-2020-7662

npmjs-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Redhat Websocket-extensions Project
Products
Openshift Service Mesh Websocket-extensions
CVE-2020-7660

npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

CVSS 3.1 · 8.1 High EPSS 3.0% KEV · Not listed
Vendors
Redhat Verizon
Products
Service Mesh Serialize-javascript
CVE-2020-28852

golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Golang Redhat
Products
Text Acm Enterprise Linux and 2 more
CVE-2020-28851

golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Enterprise Linux and 2 more