CVE-2021-43824
published 2022-02-22CVE-2021-43824: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.05%
59.9th percentile
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | < 1.18.6 | 1.18.6 |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.19.0 < 1.19.3 | 1.19.3 |
| envoyproxy | envoy | >= 1.20.0 < 1.20.2 | 1.20.2 |
| envoyproxy | envoy | >= 1.21.0 < 1.21.1 | 1.21.1 |
| github.com | pomerium_pomerium | >= 0 < 0.16.4 | 0.16.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Multiple security issues in Pomerium's embedded envoy
osv·2022-03-01·CVSS 7.5
[HIGH] Multiple security issues in Pomerium's embedded envoy
Multiple security issues in Pomerium's embedded envoy
Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.
Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.
### Impact
- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted
### Patches
Patched in v0.16.4
### Workarounds
No
### References
[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)
* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer d
GHSA
Multiple security issues in Pomerium's embedded envoy
ghsa·2022-03-01·CVSS 7.5
[HIGH] Multiple security issues in Pomerium's embedded envoy
Multiple security issues in Pomerium's embedded envoy
Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.
Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.
### Impact
- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted
### Patches
Patched in v0.16.4
### Workarounds
No
### References
[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)
* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer d
Red Hat
envoy: Null pointer dereference when using JWT filter safe_regex match
vendor_redhat·2022-02-22·CVSS 7.5
CVE-2021-43824 [HIGH] CWE-476 envoy: Null pointer dereference when using JWT filter safe_regex match
envoy: Null pointer dereference when using JWT filter safe_regex match
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.
A flaw was found in envoy. A crafted request can potentially trigger a NULL pointer dereference when using a WT filter safe_regex match.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253ahttps://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2phttps://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253ahttps://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p
2022-02-22
Published