TI-2022-06032 CVE-2022-21654
Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
Priority MEDIUM 45
Envoy is an open source edge and service proxy, designed for cloud-native applications.
RHSA-2022:1276
Red Hat OpenShift Service Mesh 2.0.9 security update
Released 2022-04-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- OpenShift Service Mesh 2.0 kiali-v1.24.7.redhat1-1.el8, servicemesh-2.0.9-3.el8, servicemesh-istioctl-2.0.9-3.el8 +6
Fixes 16 records
TI-2021-02682 CVE-2021-3749 · GHSA-cph5-m8f7-6c5x
Inefficient Regular Expression Complexity in axios/axios
Priority MEDIUM 44
axios is vulnerable to Inefficient Regular Expression Complexity
TI-2021-02215 CVE-2021-3121 · GHSA-c3h9-896r-86jm
An issue was discovered in GoGo Protobuf before 1.3.2.
Priority MEDIUM 43
An issue was discovered in GoGo Protobuf before 1.3.2.
Priority MEDIUM 42
Istio is an open platform to connect, manage, and secure microservices.
TI-2022-07687 CVE-2022-23635 · GHSA-856q-xv3c-7f2f
Unauthenticated control plane denial of service attack in Istio
Priority MEDIUM 42
Istio is an open platform to connect, manage, and secure microservices.
Priority MEDIUM 41
Envoy is an open source edge and service proxy, designed for cloud-native applications.
TI-2021-19632 CVE-2021-43826
Crash when tunneling TCP over HTTP in Envoy
Priority MEDIUM 41
Envoy is an open source edge and service proxy, designed for cloud-native applications.
TI-2021-19630 CVE-2021-43824
Null pointer dereference in envoy
Priority MEDIUM 41
Envoy is an open source edge and service proxy, designed for cloud-native applications.
TI-2021-10545 CVE-2021-29923 · GHSA-38h6-vxp4-qxvm
Go before 1.17 does not properly consider extraneous zero characters at the beginning of…
Priority LOW 39
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of…
TI-2020-17412 CVE-2020-28851 · GHSA-739f-9qhv-6594
In x/text in Go 1.15.4, an "index out of range" panic occurs in…
Priority LOW 37
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.
TI-2021-10195 CVE-2021-29482 · GHSA-25xm-hr59-7c27
denial of service in github.com/ulikunitz/xz
Priority LOW 36
xz is a compression and decompression library focusing on the xz format completely written in Go.
TI-2020-17413 CVE-2020-28852 · GHSA-5rvp-q2j7-h9rj
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in…
Priority LOW 36
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag.
TI-2021-19455 CVE-2021-43565 · GHSA-gwc9-m7rh-j2ww
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto…
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
TI-2021-19631 CVE-2021-43825
Use-after-free in Envoy
Priority LOW 34
Envoy is an open source edge and service proxy, designed for cloud-native applications.
TI-2021-14632 CVE-2021-36221 · GHSA-6qcx-qr4g-4fx9
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a…
Priority LOW 32
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
TI-2022-07659 CVE-2022-23606
Crash when a cluster is deleted in Envoy
Priority LOW 31
Envoy is an open source edge and service proxy, designed for cloud-native applications.