Vulnerability Details CVE-2021-28683
An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 31.0%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-xw4q-6pj2-5gfg
- https://blog.envoyproxy.io
- https://github.com/envoyproxy/envoy/releases
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg
Products affected by CVE-2021-28683
-
cpe:2.3:a:envoyproxy:envoy:1.16.2
-
cpe:2.3:a:envoyproxy:envoy:1.17.1