CVE-2022-29225: Zip bomb vulnerability in Envoy
A flaw was found in Envoy. A specifically constructed HTTP body delivered by an untrusted downstream or upstream peer whose decompressed size is dramatically larger than the compressed size can be sent by an attacker to cause a denial of service.
Other sources
Decompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload.
— Red Hat
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-29225?
CVE-2022-29225 is a vulnerability found in Envoy, a cloud-native high-performance proxy, where compressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody, potentially allowing an attacker to zip bomb the decompressor.
How does CVE-2022-29225 impact Envoy?
CVE-2022-29225 can allow an attacker to zip bomb the decompressor of Envoy by sending a small highly compressed payload, potentially causing resource exhaustion and denial of service.
What is the severity of CVE-2022-29225?
The severity of CVE-2022-29225 is high, with a CVSS score of 7.5.
Which versions of Envoy are affected by CVE-2022-29225?
Versions of Envoy prior to 1.22.1 are affected by CVE-2022-29225.
How can I mitigate the CVE-2022-29225 vulnerability?
To mitigate CVE-2022-29225, it is recommended to update Envoy to version 1.22.1 or later.