PT-2022-3386 · Envoy · Envoy

Shachar Menashe · Published 2022-06-09 · Updated 2024-03-06 · CVE-2022-29225

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.22.1

Description The issue is related to the decode/encodeBody component of the Envoy proxy, which can lead to uncontrolled resource consumption. An attacker can exploit this by sending a specially crafted zip file, potentially causing a denial of service due to system memory exhaustion. This can be achieved by zip bombing the decompressor, where a small highly compressed payload is sent.

Recommendations For versions prior to 1.22.1, users are advised to upgrade to a newer version to resolve the issue. As a temporary workaround, consider disabling decompression for users unable to upgrade.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-409

Related Identifiers

BDU:2022-04157

BIT-ENVOY-2022-29225

CVE-2022-29225

GHSA-75HV-2JJJ-89HH

RHSA-2022:5003

RHSA-2022:5004

Affected Products

Envoy

References · 17

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-75hv-2jjj-89hh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29225.json · Exploit
• https://github.com/envoyproxy/envoy/commit/cb4ef0b09200c720dfdb07e097092dd105450343 · Patch
• https://bdu.fstec.ru/vul/2022-04157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29225 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-9587.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29225 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9586.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9588.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2022-29225 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9589.html · Vendor Advisory
• https://t.me/cvenotify/31734 · Telegram Post
• https://jfrog.com/blog/denial-of-service-vulnerability-in-envoy-proxy-cve-2022-29225 · Note
• https://t.me/defcon_news/100003 · Telegram Post
• https://t.me/secharvester/12512 · Telegram Post