high7.5
CVE-2021-28682
An issue was discovered in Envoy through 1.71.1.
Impact
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Envoyproxy | Envoy | Versions 1.14.6, 1.15.3, 1.16.2, 1.17.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36
- https://github.com/envoyproxy/envoy/releases