OpenShift Service Mesh 2.1/servicemesh-proxy

Red Hat · Package

13 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
golang.org/x/net/http2 vulnerable to possible excessive memory growthCVE-2022-41717 · GHSA-XRJJ-MJ9H-534MVersion ranges need review.	golang.org/x/net/http2 golang.org/x/net	GoRed Hat	Medium	Fix reported	2026-02-04
golang.org/x/net vulnerable to Uncontrolled Resource ConsumptionCVE-2022-41723 · GHSA-VVPX-J8F3-3W6HVersion ranges need review.	golang.org/x/net stdlib	GoRed Hat	High	Fix reported	2026-02-04
Panic due to large inputs affecting P-256 curves in crypto/ellipticCVE-2022-28327 · GO-2022-0435	stdlib Migration Toolkit for Containers/cpma	GoRed Hat	Medium	Fix reported	2024-05-20
Stack overflow from a large amount of PEM data in encoding/pemCVE-2022-24675 · GO-2022-0433	stdlib Migration Toolkit for Containers/cpma	GoRed Hat	Medium	Fix reported	2024-05-20
envoy: X.509 Extended Key Usage and Trust Purposes bypassCVE-2022-21657	OpenShift Service Mesh 2.0/servicemesh-proxy OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	Medium	No fix reported	Not recorded
envoy: X.509 subjectAltName matching (and nameConstraints) bypassCVE-2022-21656	OpenShift Service Mesh 2.0/servicemesh-proxy OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	Medium	No fix reported	Not recorded
envoy: Internal redirect crash for requests with body/trailersCVE-2022-29227	OpenShift Service Mesh 2.0/servicemesh-proxy OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	High	No fix reported	Not recorded
envoy: envoy doesn't escape HTTP header valuesCVE-2023-27493	OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	High	No fix reported	Not recorded
envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is receivedCVE-2023-27488	OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	High	No fix reported	Not recorded
envoy: Crash when a redirect url without a state param is received in the oauth filterCVE-2023-27496	OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	Medium	No fix reported	Not recorded
envoy: Crash when a large request body is processed in Lua filterCVE-2023-27492	OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	Medium	No fix reported	Not recorded
envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstreamCVE-2023-27491	OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	Medium	No fix reported	Not recorded
envoy: Client may fake the header `x-envoy-original-path`CVE-2023-27487	OpenShift Service Mesh 2.1/servicemesh-proxy	Red Hat	High	No fix reported	Not recorded