An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Envoy | Envoyproxy | 1.16.2 (including) | 1.16.2 (including) |
| Envoy | Envoyproxy | 1.17.1 (including) | 1.17.1 (including) |
| OpenShift Service Mesh 1.1 | RedHat | servicemesh-proxy-0:1.1.13-1.el8 | * |
| OpenShift Service Mesh 2.0 | RedHat | servicemesh-proxy-0:2.0.3-1.el8 | * |
Potential Mitigations
References
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg