The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of streams are reset. Deployments are susceptible to Denial of Service when Envoy is configured with high limit on H/2 concurrent streams. An attacker wishing to exploit this vulnerability would require a client opening and closing a large number of H/2 streams. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to reduce time complexity of resetting HTTP/2 streams. As a workaround users may limit the number of simultaneous HTTP/2 dreams for upstream and downstream peers to a low number, i.e. 100.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade istio-istioctlUpgrade olcne-prometheus-chartUpgrade istio-pilot-discoveryUpgrade kubeletUpgrade istio-pilot-agentUpgrade olcnectlUpgrade olcne-nginxUpgrade olcne-api-serverUpgrade olcne-grafana-chartUpgrade kubeadmUpgrade olcne-istio-chartUpgrade olcne-olm-chartUpgrade kubectlUpgrade istioUpgrade olcne-agentUpgrade olcne-utils | Nov 9, 2021 | Aug 24, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub