high7.5
CVE-2021-29258
An issue was discovered in Envoy 1.14.0.
Impact
An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty METADATA map triggers a Reachable Assertion.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Envoyproxy | Envoy | Versions 1.14.6, 1.15.3, 1.16.2, 1.17.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy-setec/pull/230
- https://github.com/envoyproxy/envoy/releases/tag/v1.14.0
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-rqvq-hxw5-776j
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy-setec/pull/230
- https://github.com/envoyproxy/envoy/releases/tag/v1.14.0
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg