Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Crash when tunneling TCP over HTTP in Envoy
Vulnerability Description
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Type
释放后使用
Vulnerability Title
Envoy 资源管理错误漏洞
Vulnerability Description
Envoy是一款开源的分布式代理服务器。 Envoy 存在资源管理错误漏洞，该漏洞源于当为上游隧道配置envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config时发生崩溃，并且下游连接断开，而上游连接或 http/2 流仍然存在。 没有解决此问题的方法。 建议用户升级。
CVSS Information
N/A
Vulnerability Type
N/A