Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-43824

Опубликовано: 22 фев. 2022
Источник: nvd
CVSS3: 7.5
CVSS2: 4.3
EPSS Низкий

Описание

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Версия до 1.18.6 (исключая)
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Версия от 1.19.0 (включая) до 1.19.3 (исключая)
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Версия от 1.20.0 (включая) до 1.20.2 (исключая)
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Версия от 1.21.0 (включая) до 1.21.1 (исключая)

EPSS

Процентиль: 32%
0.00125
Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVSS3: 7.5
redhat
почти 4 года назад

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.

CVSS3: 7.5
debian
почти 4 года назад

Envoy is an open source edge and service proxy, designed for cloud-nat ...

EPSS

Процентиль: 32%
0.00125
Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-476