BIT-envoy-2022-23606

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/envoy/BIT-envoy-2022-23606.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-envoy-2022-23606
Aliases
Published
2024-03-06T10:55:43.299Z
Modified
2024-11-27T19:40:48.342Z
Summary
[none]
Details

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Database specific
{
    "cpes": [
        "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:envoyproxy:envoy:1.21.0:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / envoy

Package

Name
envoy
Purl
pkg:bitnami/envoy

Severity

  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.20.0
Fixed
1.20.2
Type
SEMVER
Events
Introduced
1.21.0
Last affected
1.21.0