Описание
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
A flaw was found in Envoy's ext_proc and ext_authz functions. This flaw allows a remote, unauthenticated attacker to trigger excessive memory consumption, causing a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2 | openshift-service-mesh/proxyv2-rhel8 | Affected | ||
| OpenShift Service Mesh 2 | servicemesh-proxy | Affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-400
https://bugzilla.redhat.com/show_bug.cgi?id=2283149envoy: memory DoS in ext_proc and ext_authz
EPSS
Процентиль: 6%
0.00023
Низкий
5.7 Medium
CVSS3
Связанные уязвимости
CVSS3: 5.7
nvd
больше 1 года назад
Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.
CVSS3: 5.7
debian
больше 1 года назад
Envoy is a cloud-native, open source edge and service proxy. Envoy exp ...
EPSS
Процентиль: 6%
0.00023
Низкий
5.7 Medium
CVSS3