7.5

CVE-2021-29258

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Envoyproxy ≫ Envoy Version 1.14.6
Envoyproxy ≫ Envoy Version 1.15.3
Envoyproxy ≫ Envoy Version 1.16.2
Envoyproxy ≫ Envoy Version 1.17.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.74% 0.748
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-617 Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

https://blog.envoyproxy.io
Vendor Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg
Third Party Advisory
Not Applicable
https://github.com/envoyproxy/envoy-setec/pull/230
Broken Link
https://github.com/envoyproxy/envoy/releases/tag/v1.14.0
Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-rqvq-hxw5-776j
Third Party Advisory