Phlax

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.34.1 Envoy versions prior to 1.33.3 Envoy versions prior to 1.32.6 Envoy versions prior to 1.31.8 **Description** The issue arises from Envoy's URI template matcher incorrectly excluding the `*` character from a set of valid characters in the URI path. This can lead to a bypass of Role-Based Access Control (RBAC) rules when configured using the `uri template` permissions. **Recommendations** For versions prior to 1.34.1, update to version 1.34.1 or later. For versions prior to 1.33.3, update to version 1.33.3 or later. For versions prior to 1.32.6, update to version 1.32.6 or later. For versions prior to 1.31.8, update to version 1.31.8 or later. As a temporary workaround, configure additional RBAC permissions using `url path` with `safe regex` expression.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.31.5 Envoy versions prior to 1.32.3 **Description** The issue is related to the incorrect implementation of the control flow when handling HTTP responses in the Envoy proxy server. This can lead to downstream failures in networked devices. The problem arises from Envoy not properly handling HTTP 1.1 non-101 1xx responses. **Recommendations** For Envoy versions prior to 1.31.5, upgrade to version 1.31.5 or later. For Envoy versions prior to 1.32.3, upgrade to version 1.32.3 or later. As a temporary workaround, consider restricting the use of HTTP 1.1 non-101 1xx responses until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.30.8 Envoy versions prior to 1.31.4 Envoy versions prior to 1.32.2 **Description** The issue is related to the Happy Eyeballs sorting algorithm in the Envoy proxy, which crashes when additional addresses are not IP addresses. This can be exploited by a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For versions prior to 1.30.8, upgrade to version 1.30.8 or later. For versions prior to 1.31.4, upgrade to version 1.31.4 or later. For versions prior to 1.32.2, upgrade to version 1.32.2 or later. As a temporary workaround, consider disabling the Happy Eyeballs algorithm until a patch is available. Alternatively, change the IP configuration to prevent the crash.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.26.7 Envoy versions prior to 1.27.3 Envoy versions prior to 1.28.1 Envoy versions prior to 1.29.1 **Description** The issue is related to a high-performance edge/middle/service proxy, where the regex expression is compiled for every request, resulting in high CPU usage and increased request latency when multiple routes are configured with such matchers. This can be exploited by a remote attacker to cause a denial of service. **Recommendations** For versions prior to 1.26.7, upgrade to version 1.26.7 or later. For versions prior to 1.27.3, upgrade to version 1.27.3 or later. For versions prior to 1.28.1, upgrade to version 1.28.1 or later. For versions prior to 1.29.1, upgrade to version 1.29.1 or later.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.26.7 Envoy versions prior to 1.27.3 Envoy versions prior to 1.28.1 Envoy versions prior to 1.29.1 **Description** The issue is related to pointer dereference errors in the Envoy proxy server. Exploitation of this issue may allow a remote attacker to cause a denial of service. The problem occurs when PPv2 is enabled on both a listener and a subsequent cluster, and the Envoy instance attempts to craft the upstream PPv2 header for a downstream request with a command type of LOCAL and without the protocol block. **Recommendations** For versions prior to 1.26.7, upgrade to version 1.26.7 or later. For versions prior to 1.27.3, upgrade to version 1.27.3 or later. For versions prior to 1.28.1, upgrade to version 1.28.1 or later. For versions prior to 1.29.1, upgrade to version 1.29.1 or later.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.29.1 Envoy versions prior to 1.28.1 Envoy versions prior to 1.27.3 Envoy versions prior to 1.26.7 **Description** The issue is related to a use-after-free error in the Envoy proxy server. Exploitation of this issue may allow a remote attacker to cause the application to crash. Envoy will crash when certain timeouts happen within the same interval, specifically when `hedge on per try timeout` is enabled, `per try idle timeout` is enabled, and `per-try-timeout` is enabled with its value equal to or within the backoff interval of the `per try idle timeout`. **Recommendations** For Envoy versions prior to 1.29.1, upgrade to version 1.29.1 or later. For Envoy versions prior to 1.28.1, upgrade to version 1.28.1 or later. For Envoy versions prior to 1.27.3, upgrade to version 1.27.3 or later. For Envoy versions prior to 1.26.7, upgrade to version 1.26.7 or later.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.26.7 Envoy versions prior to 1.27.3 Envoy versions prior to 1.28.1 Envoy versions prior to 1.29.1 **Description** The issue is related to Envoy crashing in Proxy protocol when using an address type that isn’t supported by the OS. Specifically, Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address. This is a valid scenario, as a client can present its IPv6 address to a target server even though the whole chain is connected via IPv4. The problem arises from an uncaught exception. **Recommendations** For versions prior to 1.26.7, upgrade to version 1.26.7 or later. For versions prior to 1.27.3, upgrade to version 1.27.3 or later. For versions prior to 1.28.1, upgrade to version 1.28.1 or later. For versions prior to 1.29.1, upgrade to version 1.29.1 or later. As a temporary workaround, consider disabling the proxy protocol on hosts with IPv6 disabled until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.27.0 Envoy versions prior to 1.26.4 Envoy versions prior to 1.25.9 Envoy versions prior to 1.24.10 Envoy versions prior to 1.23.12 **Description** The issue is related to a use-after-free error in the HTTP CORS filter of the Envoy proxy server. This can be exploited by a remote attacker to perform a denial-of-service (DoS) attack when the `origin` header is removed between `decodeHeaders` and `encodeHeaders` operations. **Recommendations** For versions prior to 1.27.0, update to version 1.27.0 or later. For versions prior to 1.26.4, update to version 1.26.4 or later. For versions prior to 1.25.9, update to version 1.25.9 or later. For versions prior to 1.24.10, update to version 1.24.10 or later. For versions prior to 1.23.12, update to version 1.23.12 or later. As a temporary workaround, do not remove the `origin` header in the Envoy configuration.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 **Description** The issue concerns escalation of privileges when `failure mode allow: true` is configured for the `ext authz` filter in Envoy, an open source edge and service proxy. This can occur when Envoy receives an HTTP header with non-UTF-8 data and is configured to use certain filters and services. As a result, Envoy may generate an invalid protobuf message, leading to unforeseen errors, including a lack of visibility into requests. In versions 1.26.0 and later, Envoy sanitizes values sent in gRPC service calls to be valid UTF-8 by default. **Recommendations** For versions prior to 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, update to version 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9 to resolve the issue. As a temporary workaround, set `failure mode allow: false` for the `ext authz` filter. To temporarily revert the behavioral change of sanitizing non-UTF-8 strings in gRPC service calls, set the runtime guard `envoy.reloadable features.service sanitize non utf8 strings` to false.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.26.0 Envoy versions prior to 1.25.3 Envoy versions prior to 1.24.4 Envoy versions prior to 1.23.6 Envoy versions prior to 1.22.9 **Description** Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to the fixed versions, there is a possibility that non-compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. **Recommendations** For versions prior to 1.26.0, update to version 1.26.0 or later. For versions prior to 1.25.3, update to version 1.25.3 or later. For versions prior to 1.24.4, update to version 1.24.4 or later. For versions prior to 1.23.6, update to version 1.23.6 or later. For versions prior to 1.22.9, update to version 1.22.9 or later.