https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:48:53 +0000 https://cve.radiocsirt.org/vuln/bit-envoy-2022-29226 <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.</p> <p><strong>Affected:</strong> Bitnami: envoy</p> <p>Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.</p> https://cve.radiocsirt.org/vuln/bit-envoy-2022-29226 https://cve.radiocsirt.org/vuln/certfr-2022-avi-543 certfr-2022-avi-543 https://cve.radiocsirt.org/vuln/certfr-2022-avi-543 https://cve.radiocsirt.org/vuln/cnvd-2022-82666 cnvd-2022-82666 https://cve.radiocsirt.org/vuln/cnvd-2022-82666 https://cve.radiocsirt.org/vuln/euvd-2026-234061 EUVD-2026-234061 https://cve.radiocsirt.org/vuln/euvd-2026-234061 https://cve.radiocsirt.org/vuln/fkie_cve-2022-29226 <p>Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.</p> <p>Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter implementation does not include a mechanism for validating access tokens, so by design when the HMAC signed cookie is missing a full authentication flow should be triggered. However, the current implementation assumes that access tokens are always validated thus allowing access in the presence of any access token attached to the request. Users are advised to upgrade. There is no known workaround for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-29226 https://cve.radiocsirt.org/vuln/gsd-2022-29226 gsd-2022-29226 https://cve.radiocsirt.org/vuln/gsd-2022-29226 https://cve.radiocsirt.org/vuln/rhsa-2022:5004 <p>golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString golang: cmd/go: misinterpretation of branch names can lead to incorrect access control golang: crypto/elliptic: IsOnCurve returns true for invalid field elements envoy: Segfault in GrpcHealthCheckerImpl envoy: Decompressors can be zip bombed envoy: oauth filter allows trivial bypass envoy: oauth filter calls continueDecoding() from within decodeHeaders() Istio: Unsafe memory access in metadata exchange.</p> <p>golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString golang: cmd/go: misinterpretation of branch names can lead to incorrect access control golang: crypto/elliptic: IsOnCurve returns true for invalid field elements envoy: Segfault in GrpcHealthCheckerImpl envoy: Decompressors can be zip bombed envoy: oauth filter allows trivial bypass envoy: oauth filter calls continueDecoding() from within decodeHeaders() Istio: Unsafe memory access in metadata exchange.</p> https://cve.radiocsirt.org/vuln/rhsa-2022:5004 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0288 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen nicht näher spezifizierten Angriff durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0288