Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connection being able to keep a worker thread in an infinite busy loop when continue_on_listener_filters_timeout is used."
References
Link | Resource |
---|---|
https://github.com/istio/istio/issues/18229 | Exploit Third Party Advisory |
https://blog.envoyproxy.io | Vendor Advisory |
https://groups.google.com/forum/#!forum/envoy-users | Mailing List Third Party Advisory |
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xvf-4396-cj46 | Exploit Third Party Advisory |
Information
Published : 2019-11-10 17:15
Updated : 2019-11-12 12:46
NVD link : CVE-2019-18836
Mitre link : CVE-2019-18836
JSON object : View
CWE
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
Products Affected
envoyproxy
- envoy
istio
- istio