Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, config…
High CVSS 7.4
Summary
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, the xDS gRPC server in GatewayNamespaceMode, configured through provider.kubernetes.deploy.type=GatewayNamespace, installs a JWT StreamInterceptor but no UnaryInterceptor, leaving every unary Fetch RPC unauthenticated. The streaming interceptor also authenticates only discoveryv3.DeltaDiscoveryRequest messages; a discoveryv3.DiscoveryRequest used by…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/envoyproxy/gateway/commit/4df0809ff1ed59ffb09604da4084335b8c6647c5
- https://github.com/envoyproxy/gateway/commit/e9124abc4ff4b63a218a6890c1b28a982c850465
- https://github.com/envoyproxy/gateway/commit/f1f9829af2a231f0cae915c09800353c76622d97
- https://github.com/envoyproxy/gateway/pull/8986
- https://github.com/envoyproxy/gateway/pull/9116
- https://github.com/envoyproxy/gateway/pull/9118
- https://github.com/envoyproxy/gateway/releases/tag/v1.7.4
- https://github.com/envoyproxy/gateway/releases/tag/v1.8.1
- https://github.com/envoyproxy/gateway/security/advisories/GHSA-22xc-xg2r-9j7v
Timeline
- nvd_ingest NVD