Skip to content
OpenAdvisories
High WID-SEC-2023-2058 11 CVEs

Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen

Published Aug 13, 2023 · Updated Oct 8, 2023 · Revision 7 · de-DE

Vendor: amazon Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Enterprise Linux < Migration Toolkit for Applications 6.2.0 Product: Linux Product: Linux Product: Linux 2 Product: openshift Product: OpenShift < Service Mesh 2.2.9 Product: OpenShift < Service Mesh 2.3.6 Containers Product: OpenShift < Service Mesh 2.4.2 Containers Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 11

  • High 8.6
    CVE-2023-35941

    Envoy vulnerable to OAuth2 credentials exploit with permanent validity

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This…

    envoyproxy envoy
  • High 8.2
    CVE-2023-27487

    Envoy client may fake the header `x-envoy-original-path`

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-…

    envoyproxy envoy
  • High 8.2
    CVE-2023-35944

    Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes

    Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can…

    envoyproxy envoy
  • High 8.1
    CVE-2023-27493

    Envoy doesn't escape HTTP header values

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to charact…

    envoyproxy envoy
  • High 7.5
    CVE-2023-35945

    Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

    Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of p…

    envoyproxy envoy nodejs cmake Azure Linux Alpine
  • Medium 6.5
    CVE-2023-27496

    Envoy may crash when a redirect url without a state param is received in the oauth filter

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redire…

    envoyproxy envoy
  • Medium 6.5
    CVE-2023-35942

    Envoy's gRPC access log crash caused by the listener draining

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is dr…

    envoyproxy envoy
  • Medium 6.3
    CVE-2023-35943

    Envoy vulnerable to CORS filter segfault when origin header is removed

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decod…

    envoyproxy envoy
  • Medium 5.4
    CVE-2023-27488

    Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For…

    envoyproxy envoy
  • Medium 5.4
    CVE-2023-27491

    Envoy forwards invalid Http2/Http3 downstream headers

    Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP…

    envoyproxy envoy
  • Medium 4.8
    CVE-2023-27492

    Envoy may crash when a large request body is processed in Lua filter

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that hav…

    envoyproxy envoy

Revision history

  1. #7

    Neue Updates von SUSE aufgenommen

  2. #6

    Neue Updates von Amazon aufgenommen

  3. #5

    Neue Updates von Red Hat aufgenommen

  4. #4

    Neue Updates von Oracle Linux aufgenommen

  5. #3

    Neue Updates von Oracle Linux aufgenommen

  6. #2

    Neue Updates von Amazon und Oracle Linux aufgenommen

  7. #1

    Initiale Fassung

References