Описание
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:redhat:openshift_service_mesh:2.5.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_service_mesh:2.6.3:*:*:*:*:*:*:*
EPSS
Процентиль: 34%
0.00407
Низкий
7.1 High
CVSS3
Дефекты
CWE-444
Связанные уязвимости
CVSS3: 7.1
redhat
больше 1 года назад
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
CVSS3: 6.3
github
больше 1 года назад
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
EPSS
Процентиль: 34%
0.00407
Низкий
7.1 High
CVSS3
Дефекты
CWE-444