CVE-2022-21655: Incorrect handling of internal redirects results in crash in Envoy
A flaw was found in envoy. Due to incorrect handling of the common router, a segfault is possible when internal redirects are routes with a direct response entry.
Other sources
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.
Incorrect handling of internal redirects to routes with a direct response entry.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-21655?
CVE-2022-21655 is a vulnerability in Envoy that can result in a denial of service due to a segfault in the common router.
How severe is CVE-2022-21655?
CVE-2022-21655 has a severity value of 7.5, which is considered high.
What is the affected software for CVE-2022-21655?
The affected software for CVE-2022-21655 includes Red Hat Service Mesh Proxy versions 0:2.0.9-3.el8 and 0:2.1.2-4.el8, as well as Envoy versions up to 1.21.1.
How can I fix CVE-2022-21655?
To fix CVE-2022-21655, you should update your Envoy installation to version 1.18.6, 1.19.3, 1.20.2, or 1.21.1.
What is the workaround for CVE-2022-21655?
As a workaround for CVE-2022-21655, you can turn off internal redirects in Envoy.