DeutschShown in its original language — a full translation is planned for a future version.
Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen
view advisory published 2023-08-13
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-35944US | medium5.3 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sens… | ||||
| CVE-2023-35943US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault… | ||||
| CVE-2023-35942US | medium6.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using lis… | ||||
| CVE-2023-35941US | critical9.8 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to… | ||||
| CVE-2023-35945US | high7.5 | — | ||
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately fo… | ||||
| CVE-2023-27496US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a… | ||||
| CVE-2023-27493US | critical9.1 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or esca… | ||||
| CVE-2023-27492US | medium6.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to… | ||||
| CVE-2023-27491US | critical9.1 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.2… | ||||
| CVE-2023-27488US | critical9.8 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is pos… | ||||
| CVE-2023-27487US | critical9.1 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2023:4623 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:4624 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:4625 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:4627 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:5174 vom 2023-09-14external
- Red Hat Security Advisory RHSA-2023:5175 vom 2023-09-14external
- Amazon Linux Security Advisory ALAS2ECS-2023-006 vom 2023-09-07external
- Amazon Linux Security Advisory ALASECS-2023-007 vom 2023-09-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan