deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-25066
Published: 2022-06-09
Description: A vulnerability has been found in ajenti 2.1.31 and classified as critical. This vulnerability affects unknown code of the component API. The manipulation leads to privilege escalation. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.32 is able to address this issue. The name of the patch is 7aa146b724e0e20cfee2c71ca78fafbf53a8767c. It is recommended to upgrade the affected component.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-78
References: https://github.com/ajenti/ajenti/commit/7aa146b724e0e20cfee2c71ca78fafbf53a8767c; https://vuldb.com/?id.143950; https://www.exploit-db.com/exploits/47497
CVE: CVE-2019-25067
Published: 2022-06-09
Description: A vulnerability, which was classified as critical, was found in Podman and Varlink 1.5.1. This affects an unknown part of the component API. The manipulation leads to Remote Privilege Escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-143949 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
References: https://github.com/containers/podman/issues/21628; https://vuldb.com/?ctiid.143949; https://vuldb.com/?id.143949
CVE: CVE-2019-25068
Published: 2022-06-09
Description: A vulnerability classified as critical was found in Axios Italia Axios RE 1.7.0/7.0.0. This vulnerability affects unknown code of the file REDefault.aspx of the component Connection Handler. The manipulation of the argument DBIDX leads to privilege escalation. The attack can be initiated remotely.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://vuldb.com/?id.139528; https://vuldb.com/?id.139528
CVE: CVE-2019-25069
Published: 2022-06-09
Description: A vulnerability, which was classified as problematic, has been found in Axios Italia Axios RE 1.7.0/7.0.0. This issue affects some unknown processing of the component Error Message Handler. The manipulation leads to information disclosure (ASP.NET). The attack may be initiated remotely.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://vuldb.com/?id.139528; https://vuldb.com/?id.139529; https://vuldb.com/?id.139528
CVE: CVE-2019-25070
Published: 2022-06-09
Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the argument name leads to basic cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-135125 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 3.5 (LOW)
CWE: CWE-80, CWE-79
References: https://github.com/wolfcms/wolfcms/issues/683; https://vuldb.com/?ctiid.135125; https://vuldb.com/?id.135125
CVE: CVE-2021-27786
Published: 2022-06-09
Description: Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-942, CWE-697
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098603; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098603
CVE: CVE-2022-1986
Published: 2022-06-09
Description: OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab[PII_REDACTED]a82; https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930; https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab[PII_REDACTED]a82
CVE: CVE-2022-1992
Published: 2022-06-09
Description: Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0; https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab; https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0
CVE: CVE-2022-1993
Published: 2022-06-09
Description: Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
CVSS Score: 8.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf; https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d; https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf
CVE: CVE-2022-25151
Published: 2022-06-09
Description: Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set the HTTP Only flag. A remote attacker could exploit this vulnerability to gain access to the management interface by using this vulnerability in combination with a successful Cross-Site Scripting attack on a user.
CVSS Score: 7.5 (HIGH)
CWE: CWE-614, CWE-732
References: https://csirt.divd.nl/CVE-2022-25151; https://csirt.divd.nl/DIVD-2021-00037; https://csirt.divd.nl/CVE-2022-25151
CVE: CVE-2022-25152
Published: 2022-06-09
Description: The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures. It is possible to require a mandatory approval process. Due to a vulnerability in the approval process, present in any version prior to 6.35.37347.20040, a malicious actor (with a valid session token) can create a procedure, bypass approval, and execute the procedure. This results in the ability for any user with a valid session token to perform arbitrary code execution and full system take-over on all agents.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-358
References: https://csirt.divd.nl/CVE-2022-25152; https://csirt.divd.nl/DIVD-2021-00037; https://csirt.divd.nl/CVE-2022-25152
CVE: CVE-2022-25153
Published: 2022-06-09
Description: The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-275
References: https://csirt.divd.nl/CVE-2022-25153; https://csirt.divd.nl/DIVD-2021-00037; https://csirt.divd.nl/CVE-2022-25153
CVE: CVE-2022-26362
Published: 2022-06-09
Description: x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362
References: http://packetstormsecurity.com/files/167718/Xen-TLB-Flush-Bypass.html; http://www.openwall.com/lists/oss-security/2022/06/09/3; http://xenbits.xen.org/xsa/advisory-401.html
CVE: CVE-2022-26363
Published: 2022-06-09
Description: x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
CVSS Score: 6.7 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/06/09/4; http://xenbits.xen.org/xsa/advisory-402.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OH65U6FTTB5MLH5A6Q3TW7KVCGOG4MYI/
CVE: CVE-2022-26364
Published: 2022-06-09
Description: x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.
CVSS Score: 6.7 (MEDIUM)
References: http://packetstormsecurity.com/files/167710/Xen-PV-Guest-Non-SELFSNOOP-CPU-Memory-Corruption.html; http://www.openwall.com/lists/oss-security/2022/06/09/4; http://xenbits.xen.org/xsa/advisory-402.html
CVE: CVE-2022-26377
Published: 2022-06-09
Description: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-444, CWE-444
References: http://www.openwall.com/lists/oss-security/2022/06/08/2; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-28330
Published: 2022-06-09
Description: Apache HTTP Server 2.4.53 and earlier on Windows may read beyond bounds when configured to process requests with the mod_isapi module.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.openwall.com/lists/oss-security/2022/06/08/3; https://httpd.apache.org/security/vulnerabilities_24.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-28614
Published: 2022-06-09
Description: The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-190, CWE-200, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/06/08/4; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-28615
Published: 2022-06-09
Description: Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-190, CWE-190
References: http://www.openwall.com/lists/oss-security/2022/06/08/9; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-29404
Published: 2022-06-09
Description: In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: http://www.openwall.com/lists/oss-security/2022/06/08/5; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-2014
Published: 2022-06-09
Description: Code Injection in GitHub repository jgraph/drawio prior to 19.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825; https://huntr.dev/bounties/911a4ada-7fd6-467a-a464-b88604b16ffc; https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825
CVE: CVE-2022-2015
Published: 2022-06-09
Description: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 19.0.2.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825; https://huntr.dev/bounties/0d32f448-155c-4b71-9291-9e8bcd522b37; https://github.com/jgraph/drawio/commit/3d3f819d7a04da7d53b37cc0ca4269c157ba2825
CVE: CVE-2022-2026
Published: 2022-06-09
Description: Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694; https://huntr.dev/bounties/dcfa6790-c609-4ed5-ba5e-8f31f98e5e11; https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694
CVE: CVE-2022-2027
Published: 2022-06-09
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694; https://huntr.dev/bounties/fb99c27c-7eaa-48db-be39-b804cb83871d; https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694
CVE: CVE-2022-2028
Published: 2022-06-09
Description: Cross-site Scripting (XSS) - Generic in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694; https://huntr.dev/bounties/588fb241-bc8f-40fc-82a4-df249956d69f; https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694
CVE: CVE-2022-2029
Published: 2022-06-09
Description: Cross-site Scripting (XSS) - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694; https://huntr.dev/bounties/9052a874-634c-473e-a2b3[PII_REDACTED]3f; https://github.com/kromitgmbh/titra/commit/e606b674a2b7564407d89e38a341d72e22b14694
CVE: CVE-2022-2036
Published: 2022-06-09
Description: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/francoisjacquet/rosariosis/commit/6e213b17e6ac3a3961e1eabcdaba1c892844398a; https://huntr.dev/bounties/c7715149-f99c-4d62-a5c6-c78bfdb41905; https://github.com/francoisjacquet/rosariosis/commit/6e213b17e6ac3a3961e1eabcdaba1c892844398a
CVE: CVE-2022-2037
Published: 2022-06-09
Description: Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1125
References: https://github.com/tooljet/tooljet/commit/fadf025365823cbbc739a1313791c0a04621972b; https://huntr.dev/bounties/4431ef84-93f2-4bc5-bc1a-97d7f229b28e; https://github.com/tooljet/tooljet/commit/fadf025365823cbbc739a1313791c0a04621972b
CVE: CVE-2022-30522
Published: 2022-06-09
Description: If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
CVSS Score: 7.5 (HIGH)
CWE: CWE-789, CWE-770
References: http://www.openwall.com/lists/oss-security/2022/06/08/6; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-30556
Published: 2022-06-09
Description: Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2022/06/08/7; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-31038
Published: 2022-06-09
Description: Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commit 155cae1d which sanitizes `DisplayName` prior to display to the user. All users of gogs are advised to upgrade. Users unable to upgrade should check their users' display names for malicious characters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gogs/gogs/commit/155cae1de8916fc3fde78f350763034b7422caee; https://github.com/gogs/gogs/pull/7009; https://github.com/gogs/gogs/security/advisories/GHSA-xq4v-vrp9-vcf2
CVE: CVE-2022-31813
Published: 2022-06-09
Description: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-348, CWE-345
References: http://www.openwall.com/lists/oss-security/2022/06/08/8; https://httpd.apache.org/security/vulnerabilities_24.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7QUGG2QZWHTITMABFLVXA4DNYUOTPWYQ/
CVE: CVE-2022-24876
Published: 2022-06-09
Description: GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6; https://github.com/glpi-project/glpi/security/advisories/GHSA-33g2-m556-gccr; https://github.com/glpi-project/glpi/commit/9a3c7487c8761eaa8f3b07589d6dcdfa5d1e4ed6
CVE: CVE-2022-29224
Published: 2022-06-09
Description: Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health checking. One of them uses gRPC. Envoy also has a feature which can “hold” (prevent removal) upstream hosts obtained via service discovery until configured active health checking fails. If an attacker controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.), an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or replace it with a different health checking type as a mitigation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db; https://github.com/envoyproxy/envoy/security/advisories/GHSA-m4j9-86g3-8f49; https://github.com/envoyproxy/envoy/commit/9b1c3962172a972bc0359398af6daa3790bb59db
CVE: CVE-2022-30898
Published: 2022-06-09
Description: A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/chshcms/cscms/issues/37; https://github.com/chshcms/cscms/issues/37
CVE: CVE-2022-29225
Published: 2022-06-09
Description: Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-409
References: https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343; https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh; https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343
CVE: CVE-2022-29226
Published: 2022-06-09
Description: Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360; https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh; https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360
CVE: CVE-2022-29227
Published: 2022-06-09
Description: Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, there’s a lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the redirect headers are processed, the downstream state indicates that the downstream stream is not complete. On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to upgrade are advised to disable internal redirects if crashes are observed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416, CWE-416
References: https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab; https://github.com/envoyproxy/envoy/security/advisories/GHSA-rm2p-qvf6-pvr6; https://github.com/envoyproxy/envoy/commit/fe7c69c248f4fe5a9080c7ccb35275b5218bb5ab