CVE-2021-29492 - log back

CVE-2021-29492 edited at 12 May 2021 07:52:45
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Authentication bypass
Description
+ Envoy before version 1.18.3, and subsequently Istio before version 1.9.5, contains a remotely exploitable authorization bypass vulnerability. An attacker can potentially craft an HTTP request that defines a certain pattern of escaped characters in the URI path (such as %2F, %2f, %5C or %5c), allowing them to bypass the authorization service.
References
+ https://istio.io/latest/news/releases/1.9.x/announcing-1.9.5/
+ https://bugzilla.redhat.com/show_bug.cgi?id=1951188
+ https://github.com/envoyproxy/envoy/commit/b7d7c09cd4c542f6961ddae2273e9232483c29b7
CVE-2021-29492 created at 12 May 2021 07:49:10
Severity
+ Unknown
Remote
+ Unknown
Type
+ Unknown
Description
References
Notes