Description (CNA)
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| envoyproxy / envoy | affected >= 1.7.0, < 1.18.6; affected >= 1.19.0, < 1.19.3; affected >= 1.20.0, < 1.20.2; affected >= 1.21.0, < 1.21.1 |
CWE
CWE-295
References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
- https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.