Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-gr41-e8vp-sbfd |
|---|
| Summary | Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the `REQUESTED_SERVER_NAME` field for access loggers. This issue has been addressed in versions 1.31.2, 1.30.6, 1.29.9, and 1.28.7. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
|---|
| Aliases |
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
|
|---|
| References |
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
117 |
| name |
Improper Output Neutralization for Logs |
| description |
The product does not neutralize or incorrectly neutralizes output that is written to logs. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 6.5 - 6.5 |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-gr41-e8vp-sbfd |
|---|