SB2022022248 - Multiple vulnerabilities in envoy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022022248

SB2022022248 - Multiple vulnerabilities in envoy

Published: February 22, 2022 Updated: August 27, 2026

Security Bulletin ID SB2022022248
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Improper handling of exceptional conditions (CVE-ID: CVE-2022-23606)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper handling in the cluster discovery service when deleting a cluster. A remote privileged user can delete a cluster via the cluster discovery service to cause a denial of service.


2) Improper Certificate Validation (CVE-ID: CVE-2022-21657)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass certificate trust purpose restrictions.

The vulnerability exists due to improper certificate validation in X.509 extended key usage and trust purpose verification when validating certificates. A remote user can present a crafted certificate to bypass certificate trust purpose restrictions.


3) Improper Certificate Validation (CVE-ID: CVE-2022-21656)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass X.509 subjectAltName matching and nameConstraints checks.

The vulnerability exists due to improper certificate validation in X.509 subjectAltName matching and nameConstraints processing when validating certificates. A remote user can present a specially crafted certificate to bypass X.509 subjectAltName matching and nameConstraints checks.


4) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2022-21655)

CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of internal redirects in direct response routes when processing requests. A remote attacker can send a specially crafted request to cause a denial of service.


5) Configuration (CVE-ID: CVE-2022-21654)

CWE-ID: CWE-16 - Configuration

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass mutual TLS client certificate re-validation and reuse an existing session under outdated validation settings.

The vulnerability exists due to improper configuration handling in mTLS session validation in envoy when reusing an existing session after validation settings have changed. A remote user can continue using a previously established session to bypass mutual TLS client certificate re-validation and reuse an existing session under outdated validation settings.

User interaction is required.


6) NULL pointer dereference (CVE-ID: CVE-2021-43824)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the JWT filter safe_regex match functionality when processing crafted input. A remote attacker can trigger the vulnerable code path to cause a denial of service.

User interaction is required to process the crafted input.


7) Use-after-free (CVE-ID: CVE-2021-43825)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to affect integrity and availability of the service.

The vulnerability exists due to use-after-free in response filters when processing responses whose size is increased beyond downstream buffer limits. A remote attacker can trigger response processing with expanded response data to affect integrity and availability of the service.

User interaction is required for exploitation.


8) Use-after-free (CVE-ID: CVE-2021-43826)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to affect integrity and availability.

The vulnerability exists due to use-after-free in the TCP-over-HTTP tunneling functionality when handling a downstream disconnect during upstream connection establishment. A remote attacker can trigger a downstream disconnect condition to affect integrity and availability.

User interaction is required.


Remediation

Install update from vendor's website.

References