Affected: Bitnami: envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.

istioctl-1.30.4-1.1 on GA media

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls envoy: envoy: ext_authz use-after-free after rejecting an HTTP request net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages envoy: envoy: path matching bypass via per-segment parameters not stripped by router envoy: envoy: HTTP/2 trailers without END_STREAM in oghttp2 cause heap use-after-free envoy: envoy: stored XSS through dynamically generated stat names in admin interface envoy: envoy: ext_authz crash on CONNECT requests without :path pseudo-header envoy: envoy: connection poisoning through generic non-WebSocket HTTP upgrade requests envoy: envoy: scoped IPv6 handling crash for HTTP/3 clients in original DST clusters envoy: envoy: HTTP/2 memory exhaustion via discarded Host headers not counted in limits envoy: envoy: path normalization bypass via dot/dot-dot segments with parameters envoy: envoy: RBAC safe_regex fails to match non-UTF-8 HTTP header values e…