CVE-2021-29258

HIGH7.5EPSS 0.12%

發布日:2024/3/6修改日:2025/4/3

描述

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.

受影響套件(1)

Bitnami/envoy>= 1.14.6, < 1.14.7, >= 1.15.3, < 1.15.4, >= 1.16.2, < 1.16.3, >= 1.17.1, < 1.17.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(6)

WEBhttps://blog.envoyproxy.io
WEBhttps://github.com/envoyproxy/envoy/releases/tag/v1.14.0
WEBhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-rqvq-hxw5-776j
WEBhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg
WEBhttps://github.com/envoyproxy/envoy-setec/pull/230
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2021-29258