7.5
CVE-2022-21655
- EPSS 0.04%
- Published 22.02.2022 23:15:11
- Last modified 21.11.2024 06:45:09
- Source security-advisories@github.com
- Teams watchlist Login
- Open Login
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.
Data is provided by the National Vulnerability Database (NVD)
Envoyproxy ≫ Envoy Version < 1.18.6
Envoyproxy ≫ Envoy Version >= 1.19.0 < 1.19.3
Envoyproxy ≫ Envoy Version >= 1.20.0 < 1.20.2
Envoyproxy ≫ Envoy Version >= 1.21.0 < 1.21.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.108 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
| security-advisories@github.com | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-670 Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.