Описание
Security update for envoy-proxy
This update for envoy-proxy fixes the following issues:
Update to 1.14.6:
- CVE-2020-35471: Fixed a denial of service via dropped and truncated UDP datagrams (boo#1180121).
Список пакетов
SUSE Package Hub 15 SP3
openSUSE Leap 15.3
Ссылки
- E-Mail link for openSUSE-SU-2022:0065-1
- SUSE Security Ratings
- SUSE Bug 1167073
- SUSE Bug 1173559
- SUSE Bug 1180121
- SUSE CVE CVE-2020-12603 page
- SUSE CVE CVE-2020-12604 page
- SUSE CVE CVE-2020-12605 page
- SUSE CVE CVE-2020-35471 page
- SUSE CVE CVE-2020-8663 page
Описание
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.
Затронутые продукты
Ссылки
- CVE-2020-12603
- SUSE Bug 1173559
Описание
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
Затронутые продукты
Ссылки
- CVE-2020-12604
- SUSE Bug 1173559
Описание
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.
Затронутые продукты
Ссылки
- CVE-2020-12605
- SUSE Bug 1173559
Описание
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500.
Затронутые продукты
Ссылки
- CVE-2020-35471
- SUSE Bug 1180121
Описание
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.
Затронутые продукты
Ссылки
- CVE-2020-8663
- SUSE Bug 1173559