Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Remediation

References

CVE-2022-23606

Related Vulnerabilities

Dolibarr Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-19210)

WordPress Plugin YITH WooCommerce Request A Quote Security Bypass (1.4.7)

WordPress Plugin Tutor LMS-eLearning and online course solution Security Bypass (2.7.0)

WordPress Plugin Database for Contact Form 7, WPforms, Elementor forms Cross-Site Scripting (1.1.5)

WordPress Plugin Top 10-Popular posts for WordPress Cross-Site Scripting (2.3.0)

Severity

Medium

Classification

CVE-2022-23606 CWE-674 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities