Published: 09/06/2022 Updated: 16/06/2022

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Envoy is a cloud-native high-performance proxy. In versions before 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
envoyproxy envoy

Synopsis Important: Red Hat OpenShift Service Mesh 213 Containers security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Service Mesh 213Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed sever ...

Synopsis Critical: Red Hat OpenShift Service Mesh 213 security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Service Mesh 213 has been releasedRed Hat Product Security has rated this update ...

A flaw was found in Envoy The OAuth filter does not include an implementation for validating access tokens, allowing remote attackers to bypass authentication to Envoy by providing any token value ...

CWE-306 https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360 https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh https://access.redhat.com/errata/RHSA-2022:5006 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2022-29226

CVE-2022-29226

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect