CVE-2022-29225

mediumPriorität · verfolgen · 31EPSS 0.016 · 75. PerzentilDEEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.58% (75th) EPSS

CVSS 5 · medium

Is it mine?

69 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenservicemesh-proxy-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:5003
Behobenservicemesh-proxy-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:5003
Behobenservicemesh-proxy-0:2.0.10-1.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:5003
Behobenservicemesh-proxy-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2022:5003
Workaroundservicemesh-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-0:2.0.10-1.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-cni-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-cni-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-cni-0:2.0.10-1.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-cni-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-istioctl-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-istioctl-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-istioctl-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-mixc-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-mixc-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-mixc-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-mixs-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-mixs-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-mixs-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-operator-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-operator-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-operator-0:2.0.10-1.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-operator-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-pilot-agent-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-pilot-agent-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-pilot-agent-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-pilot-discovery-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-pilot-discovery-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-pilot-discovery-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-prometheus-0:2.14.0-17.el8.1.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-prometheus-0:2.14.0-17.el8.1.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-prometheus-0:2.14.0-17.el8.1.src as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-prometheus-0:2.14.0-17.el8.1.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-proxy-0:2.0.10-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-proxy-0:2.0.10-1.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-proxy-0:2.0.10-1.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.
Workaroundservicemesh-proxy-0:2.0.10-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
This can be mitigated by disabling decompression in Envoy.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Red Hat Product Security US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-400USCWE-400USCWE-409USCWE-409US

betroffene Produkte (69)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Atlassian Bitbucket <10.0.2alle Versionencert_bundDE
Atlassian Bitbucket <8.19.25 (LTS)alle Versionencert_bundDE
Atlassian Bitbucket <9.4.13 (LTS)alle Versionencert_bundDE
Gentoo Linuxalle Versionencert_bundDEcpe:/o:gentoo:linux:-
IBM Spectrum Protect <10.1.14alle Versionencert_bundDE
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat Enterprise Linux Service Interconnect 1alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:service_interconnect_1
Red Hat JBoss Enterprise Application Platform <7.3.13alle Versionencert_bundDE
Red Hat OpenShiftalle Versionencert_bundDEcpe:/a:redhat:openshift:-
Red Hat OpenShift Container Platform <4.11.44alle Versionencert_bundDE
Red Hat OpenShift Developer Tools and Services 4.11alle Versionencert_bundDEcpe:/a:redhat:openshift:developer_tools_and_services_4.11
Red Hat OpenShift OpenShift Service Mesh <2.1.3alle Versionencert_bundDE
Red Hat OpenShift Service Mesh <2.0.10alle Versionencert_bundDE
Tenable Security Nessus <10.3.1alle Versionencert_bundDE
Tenable Security Nessus Network Monitor <6.2.0alle Versionencert_bundDE
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
Atlassian Bitbucket< 10.0.2cert_bundDE
Atlassian Bitbucket< 8.19.25 (LTS)cert_bundDE

20 von 69 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2022:5003Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.10 security update2022-06-13csaf · redhat_csafUS
An update is now available for Red Hat OpenShift Service Mesh 2.0.10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2022-0288Red Hat OpenShift: Mehrere SchwachstellenDeutsch2022-06-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.
BIT-envoy-2022-29225Zip bomb vulnerability in Envoy2024-03-06vendor · osvUS
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund redhat_csaf NVD CVE.org MITRE

veröffentlicht 2022-06-09geändert 2026-06-17

Referenzen (14)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan