Description
Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.30.0, <= 1.30.1, >= 1.29.0, <= 1.29.4, >= 1.28.0, <= 1.28.3, > 1.18.0, <= 1.27.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ecs-service-connect-agent | v1.29.5.0-1.amzn2023 | ALAS2023-2024-647 |
Advisories 1
- ALAS2023-2024-647 Important: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 17, 2024