Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
s of the original file, including textual data in many cases. Versions 15.0.0-alpha.10, 14.0.0, 13.3.0, 12.1.0, and 11.5.0 all contain a fix for the vulnerability. Two workarounds aside from upgrading are available. One may make the vulnerability significantly more difficult for an attacker to exploit by enabling `contextIsolation` in one's app. One may also disable the functionality of the `createThumbnailFromPath` API if one does not need it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/electron/electron/security/advisories/GHSA-mpjm-v997-c4h4 - https://github.com/electron/electron/pull/30728
CVE ID: CVE-2021-39185 State: PUBLISHED Published: 2021-09-01T19:25:09 Last Updated: 2024-08-04T01:58:18.235Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: http4s Products: http4s Problem Types: CWE-346 Description: Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. Se
fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/http4s/http4s/security/advisories/GHSA-52cf-226f-rhr6 - https://github.com/http4s/http4s/releases/tag/v0.23.2
CVE ID: CVE-2021-39186 State: PUBLISHED Published: 2021-09-01T20:35:12 Last Updated: 2024-08-04T01:58:18.137Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: miraheze Products: GlobalNewFiles Problem Types: CWE-20 Description: GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible. Addi
ow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-57p5-hqjq-h7vg - https://github.com/miraheze/GlobalNewFiles/commit/cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d - https://phabricator.miraheze.org/T7935
CVE ID: CVE-2021-39187 State: PUBLISHED Published: 2021-09-02T15:35:11 Last Updated: 2024-08-04T01:58:18.269Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-74 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to e
rver cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x - https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec - https://github.com/parse-community/parse-server/releases/tag/4.10.3 - https://jira.mongodb.org/browse/NODE-3463
CVE ID: CVE-2021-39189 State: PUBLISHED Published: 2021-09-15T13:50:13 Last Updated: 2024-08-04T01:58:18.264Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pimcore Products: pimcore Problem Types: CWE-204 Description: Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9 - https://github.com/pimcore/pimcor
rences: - https://github.com/pimcore/pimcore/security/advisories/GHSA-579x-cjvr-cqj9 - https://github.com/pimcore/pimcore/pull/10223.patch - https://github.com/pimcore/pimcore/pull/10223/commits/d0a4de39cf05dce6af71f8ca039132bdfcbb0dce - https://huntr.dev/bounties/12462a99-ebf8-4e39-80b3-54a16caa3f4c/
CVE ID: CVE-2021-39190 State: PUBLISHED Published: 2022-09-22T16:30:15.000Z Last Updated: 2025-04-23T16:56:34.675Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pluginsGLPI Products: sccm Problem Types: CWE-200 Description: The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM (version 1802) to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pluginsGLPI/sccm/security/advisories/GHSA-3324-57w6-jxcq - https://github.
ulnrichment: References: - https://github.com/pluginsGLPI/sccm/security/advisories/GHSA-3324-57w6-jxcq - https://github.com/pluginsGLPI/sccm/commit/29a7f92d32a0cf9aa3f22c52c50b738274d2813e
CVE ID: CVE-2021-39191 State: PUBLISHED Published: 2021-09-03T00:00:00 Last Updated: 2024-08-04T01:58:18.283Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: zmartzone Products: mod_auth_openidc Problem Types: CWE-601 Description: mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 mad
to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-2pgf-8h6h-gqg2 - https://github.com/zmartzone/mod_auth_openidc/issues/672 - https://github.com/zmartzone/mod_auth_openidc/commit/03e6bfb446f4e3f27c003d30d6a433e5dd8e2b3d - https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9.4 - https://lists.fedoraproje
003d30d6a433e5dd8e2b3d - https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9.4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32RGPW5LZDLDTB7MKZIGAHPSLFOUNWR5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RHXO4O4G2UQS7X6OQJCVZKHZAQ7SAIFB/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00020.html
CVE ID: CVE-2021-39192 State: PUBLISHED Published: 2021-09-03T14:50:09 Last Updated: 2024-08-04T01:58:18.191Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: TryGhost Products: Ghost Problem Types: CWE-200 Description: Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recomme
host version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TryGhost/Ghost/security/advisories/GHSA-j5c2-hm46-wp5c - https://github.com/TryGhost/Ghost/releases/tag/v4.10.0
CVE ID: CVE-2021-39193 State: PUBLISHED Published: 2021-09-03T17:45:11 Last Updated: 2024-08-04T01:58:18.337Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: paritytech Products: frontier Problem Types: CWE-20 Description: Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be includ
way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints. A patch is available in commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26. There are no workarounds aside from applying the patch. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/paritytech/frontier/security/advisories/GHSA-hw4v-5x4h-c3xm - https://github.com/paritytech/frontier/pull/465 - https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849ae - https://github.co
5 - https://github.com/paritytech/frontier/pull/465/commits/8a2b890a2fb477d5fedd0e4335b00623832849ae - https://github.com/paritytech/frontier/commit/0b962f218f0cdd796dadfe26c3f09e68f7861b26
CVE ID: CVE-2021-39194 State: PUBLISHED Published: 2021-09-07T19:25:10 Last Updated: 2024-08-04T01:58:18.227Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: charleskorn Products: kaml Problem Types: CWE-835 Description: kaml is an open source implementation of the YAML format with support for kotlinx.serialization. In affected versions attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style.
f service. This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected. YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue. Version 0.35.3 or later contain the fix for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/charleskorn/kaml/security/advisories/GHSA-fmm9-3gv8-58f4 - https://github.com/charleskorn/kaml/issues/179 - https://github.com/charleskorn/kaml/commit/e18785d043fc6324c81e968aae9764b4b060bc6a
CVE ID: CVE-2021-39195 State: PUBLISHED Published: 2021-09-07T19:00:12 Last Updated: 2024-08-04T01:58:18.269Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: misskey-dev Products: misskey Problem Types: CWE-918 Description: Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by approp
you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/misskey-dev/misskey/security/advisories/GHSA-mqv7-gxh4-r5vf - https://github.com/misskey-dev/misskey/commit/e1a8b158e04ad567d92d8daf3cc0898ee18f1a2e - https://github.com/misskey-dev/misskey/blob/develop/CHANGELOG.md#12900-20210904
CVE ID: CVE-2021-39196 State: PUBLISHED Published: 2021-09-07T18:55:11 Last Updated: 2024-08-04T01:58:18.288Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: jdhwpgmbca Products: pcapture Problem Types: CWE-287 Description: pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is important because the capture filters can effectively limit the scope of information that a user can see in the data captures. If no filter is present, then all data on the local net
e scope of information that a user can see in the data captures. If no filter is present, then all data on the local network segment where the program is running can be captured and downloaded. v3.12 fixes this problem. There is no workaround, you must upgrade to v3.12 or greater. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jdhwpgmbca/pcapture/security/advisories/GHSA-3r67-fxpr-p2qx - https://github.com/jdhwpgmbca/pcapture/issues/7 - https://github.com/jdhwpgmbca/pcapture/commit/0f74f431e0970a2e5784dbd955cfa4760e3b1ef7
CVE ID: CVE-2021-39197 State: PUBLISHED Published: 2021-09-07T17:30:11 Last Updated: 2024-08-04T01:58:18.263Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: BetterErrors Products: better_errors Problem Types: CWE-352 Description: better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protecti
"Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks. As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent). Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate t
mmended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate the risk of using older releases of better_errors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BetterErrors/better_errors/security/advisories/GHSA-w3j4-76qw-wwjm - https://github.com/BetterErrors/better_errors/pull/474 - https://github.com/BetterErrors/better_errors/commit/8e8e796bfbde4aa088741823c8a3fc6df2089bb0 - https://github.com/BetterErrors/better_errors/discussions/507
CVE ID: CVE-2021-39198 State: PUBLISHED Published: 2021-11-19T21:30:09 Last Updated: 2024-08-04T01:58:18.171Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: oroinc Products: crm Problem Types: CWE-352 Description: OroCRM is an open source Client Relationship Management (CRM) application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack. There are no workarounds that address this vulnerability and all users are advised to update their package. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/oroinc/crm/security/ad
heir package. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/oroinc/crm/security/advisories/GHSA-vf7h-6246-hm43
CVE ID: CVE-2021-39199 State: PUBLISHED Published: 2021-09-07T18:50:11 Last Updated: 2024-08-04T01:58:18.276Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: remarkjs Products: remark-html Problem Types: CWE-79 Description: remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by
rough leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/remarkjs/remark-html/security/advisories/GHSA-9q5w-79cv-947m - https://github.com/remarkjs/remark-html/commit/b75c9dde582ad87ba498e369c033dc8a350478c1 - https://github.com/remarkjs/remark-html/releases/tag/14.0.1 - https://www.npmjs.com/package/remark-html
CVE ID: CVE-2021-39200 State: PUBLISHED Published: 2021-09-09T21:25:09 Last Updated: 2024-08-04T01:58:18.328Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-200 Description: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommen
s has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-m9hc-7v5q-x8q5 - https://hackerone.com/reports/1142140 - https://www.debian.org/security/2021/dsa-4985
CVE ID: CVE-2021-39201 State: PUBLISHED Published: 2021-09-09T21:35:08 Last Updated: 2024-08-04T01:58:18.168Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-79 Description: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older vers
rmission to post `unfiltered_html`. ### Patches This has been patched in WordPress 5.8, and will be pushed to older versions via minor releases (automatic updates). It's strongly recommended that you keep auto-updates enabled to receive the fix. ### References https://wordpress.org/news/category/releases/ https://hackerone.com/reports/1142140 ### For more information If you have any questions or comments about this advisory: * Open an issue in [HackerOne](https://hackerone.com/wordpress) Additional Analyst Notes: - CVE Program Container: References: - https://hackerone.com/reports/1142140 - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94v - https://www.d
reports/1142140 - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-wh69-25hr-h94v - https://www.debian.org/security/2021/dsa-4985
CVE ID: CVE-2021-39202 State: PUBLISHED Published: 2021-09-09T21:55:11 Last Updated: 2024-08-04T01:58:18.268Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-79 Description: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8. Additional Analy
has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fr6h-3855-j297 - https://hackerone.com/reports/1222797
CVE ID: CVE-2021-39203 State: PUBLISHED Published: 2021-09-09T22:00:11 Last Updated: 2024-08-04T01:58:18.303Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: WordPress Products: wordpress-develop Problem Types: CWE-200 Description: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. Additional Analyst Notes: - CVE Program Contai
5.8 beta during the testing period. It's fixed in the final 5.8 release. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-qxvw-qxm9-qvg6 - https://hackerone.com/reports/1225282
CVE ID: CVE-2021-39204 State: PUBLISHED Published: 2021-09-09T22:10:09 Last Updated: 2024-08-04T01:58:18.254Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: pomerium Products: pomerium Problem Types: CWE-834 Description: Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity. This can lead to high CPU utilization when a large number of streams are reset. This can result in a DoS condition. Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched. Additional Analyst Notes: - CVE Program Container: References:
an upgraded envoy binary with this vulnerability patched. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ - https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc - https://github.com/pomerium/pomerium/security/advisories/GHSA-5wjf-62hw-q78r