Description
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The connection state is transitioned to DRAINING when it receives a SETTING frame with the SETTINGS_MAX_CONCURRENT_STREAMS parameter set to 0. Receiving these two frames in the same I/O event results in abnormal termination of the Envoy process due to invalid state transition from CLOSED to DRAINING. A sequence of H/2 frames delivered by an untrusted upstream server will result in Denial of Service in the presence of untrusted **upstream** servers. Envoy versions 1.19.1, 1.18.4 contain fixes to stop processing of pending H/2 frames after connection transition to the CLOSED state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.19.0, < 1.19.1, >= 1.18.0, < 1.18.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | istio +1 | 1.10.4-3.el8 | ELSA-2021-9546 |
| Oracle Linux 8 | kubeadm +2 | 1.20.11-4.el8 | ELSA-2021-9546 |
| Oracle Linux 8 | olcnectl +8 | 1.3.2-2.el8 | ELSA-2021-9546 |
| Oracle Linux 7 | istio +3 | 1.9.8-3.el8 | ELSA-2021-9526, ELSA-2021-9525 |
| Oracle Linux 7 | kubeadm +2 | 1.20.11-4.el7 | ELSA-2021-9526 |
| Oracle Linux 7 | olcne-olm-chart +1 | 1.3.2-2.el7 | ELSA-2021-9526 |
| Oracle Linux 7 | olcnectl +6 | 1.2.5-2.el8 | ELSA-2021-9526, ELSA-2021-9525 |
Advisories 3
- ELSA-2021-9525 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 10, 2021
- ELSA-2021-9546 Important: olcne istio istio kubernetes security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 9, 2021
- ELSA-2021-9526 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Nov 9, 2021