Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| envoyproxy | envoy | >= 1.38.0, < 1.38.3, >= 1.37.0, < 1.37.5 | |
| Red Hat | OpenShift Service Mesh 2 | — | |
| Red Hat | OpenShift Service Mesh 3 | — |
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* ≥ 1.37.0 < 1.37.5cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* ≥ 1.38.0 < 1.38.3Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.