CVE-2021-28682

Опубликовано: 20 мая 2021

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

Ссылки

https://blog.envoyproxy.io
Vendor Advisory
https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36
Exploit
Third Party Advisory
https://github.com/envoyproxy/envoy/releases
Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
Third Party Advisory
https://blog.envoyproxy.io
Vendor Advisory
https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36
Exploit
Third Party Advisory
https://github.com/envoyproxy/envoy/releases
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:envoyproxy:envoy:1.14.6:*:*:*:*:*:*:*

cpe:2.3:a:envoyproxy:envoy:1.15.3:*:*:*:*:*:*:*

cpe:2.3:a:envoyproxy:envoy:1.16.2:*:*:*:*:*:*:*

cpe:2.3:a:envoyproxy:envoy:1.17.1:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00095

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

CVE-2021-28682

CVSS3: 7.5

redhat

почти 5 лет назад

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

CVE-2021-28682

CVSS3: 7.5

debian

больше 4 лет назад

An issue was discovered in Envoy through 1.71.1. There is a remotely e ...

ELSA-2021-9399

oracle-oval

больше 4 лет назад

ELSA-2021-9399: olcne security update (IMPORTANT)

ELSA-2021-9398

oracle-oval

больше 4 лет назад

ELSA-2021-9398: olcne security update (IMPORTANT)

ELSA-2021-9397

oracle-oval

больше 4 лет назад

ELSA-2021-9397: olcne security update (IMPORTANT)

EPSS

Процентиль: 27%

0.00095

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-190