kritik
CVE-2022-29226
envoy: oauth filter allows trivial bypass
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Red Hat, Bitnami. Daha düşük diyenler: Oracle (yüksek).
Açıklama
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.22.1 |
| Oracle Linux 7 | cri-o, cri-tools, etcd ve 19 tane daha | 1.23.3-1.el7 ve 7 tane daha |
| Oracle Linux 8 | cri-o, cri-tools, etcd ve 19 tane daha | 1.23.3-1.el8 ve 7 tane daha |
3 kaynaktaki 45 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.22.1 |
| Oracle Linux 7 | cri-o | 1.23.3-1.el7 |
| Oracle Linux 7 | cri-tools | 1.23.0-1.el7 |
| Oracle Linux 7 | etcd | 3.5.1-2.el7 |
| Oracle Linux 7 | istio | 1.13.5-1.el7 |
| Oracle Linux 7 | istio-istioctl | 1.13.5-1.el7 |
| Oracle Linux 7 | kata | 1.12.1-5.el7 |
| Oracle Linux 7 | kubeadm | 1.23.7-1.el7 |
| Oracle Linux 7 | kubectl | 1.23.7-1.el7 |
| Oracle Linux 7 | kubelet | 1.23.7-1.el7 |
| Oracle Linux 7 | olcne-agent | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-api-server | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-gluster-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-grafana-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-istio-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-metallb-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-nginx | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-oci-ccm-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-oci-csi-chart | 1.4.6-2.el7 |
| Oracle Linux 7 | olcne-olm-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-prometheus-chart | 1.5.4-3.el7 |
| Oracle Linux 7 | olcne-utils | 1.5.4-3.el7 |
| Oracle Linux 7 | olcnectl | 1.5.4-3.el7 |
| Oracle Linux 8 | cri-o | 1.23.3-1.el8 |
| Oracle Linux 8 | cri-tools | 1.23.0-1.el8 |
| Oracle Linux 8 | etcd | 3.5.1-2.el8 |
| Oracle Linux 8 | istio | 1.13.5-1.el8 |
| Oracle Linux 8 | istio-istioctl | 1.13.5-1.el8 |
| Oracle Linux 8 | kata | 1.12.1-5.el8 |
| Oracle Linux 8 | kubeadm | 1.23.7-1.el8 |
| Oracle Linux 8 | kubectl | 1.23.7-1.el8 |
| Oracle Linux 8 | kubelet | 1.23.7-1.el8 |
| Oracle Linux 8 | olcne-agent | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-api-server | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-gluster-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-grafana-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-istio-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-metallb-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-nginx | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-oci-ccm-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-oci-csi-chart | 1.4.6-2.el8 |
| Oracle Linux 8 | olcne-olm-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-prometheus-chart | 1.5.4-3.el8 |
| Oracle Linux 8 | olcne-utils | 1.5.4-3.el8 |
| Oracle Linux 8 | olcnectl | 1.5.4-3.el8 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2022-29226
- https://github.com/envoyproxy/envoy/commit/7ffda4e809dec74449ebc330cebb9d2f4ab61360
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-h45c-2f94-prxh
- https://linux.oracle.com/cve/CVE-2022-29226.html
- https://linux.oracle.com/errata/ELSA-2022-9589.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-29226
- https://www.cve.org/CVERecord?id=CVE-2022-29226