DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-08-13
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.
01
beschreibt (11)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-35944US | medium5.3 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sens… | ||||
| CVE-2023-35943US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault… | ||||
| CVE-2023-35942US | medium6.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using lis… | ||||
| CVE-2023-35941US | critical9.8 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to… | ||||
| CVE-2023-35945US | high7.5 | — | ||
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately fo… | ||||
| CVE-2023-27496US | high7.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a… | ||||
| CVE-2023-27493US | critical9.1 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or esca… | ||||
| CVE-2023-27492US | medium6.5 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to… | ||||
| CVE-2023-27491US | critical9.1 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.2… | ||||
| CVE-2023-27488US | critical9.8 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is pos… | ||||
| CVE-2023-27487US | critical9.1 | — | ||
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2023:4623 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:4624 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:4625 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:4627 vom 2023-08-13external
- Red Hat Security Advisory RHSA-2023:5174 vom 2023-09-14external
- Red Hat Security Advisory RHSA-2023:5175 vom 2023-09-14external
- Amazon Linux Security Advisory ALAS2ECS-2023-006 vom 2023-09-07external
- Amazon Linux Security Advisory ALASECS-2023-007 vom 2023-09-27external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan