Potential null pointer dereference when using JWT filter safe_regex match

Moderate

mattklein123 published GHSA-vj5m-rch8-5r2p

Feb 22, 2022

Package

No package listed

Affected versions

V1.21.0 and earlier

Patched versions

1.18.6, 1.19.3, 1.20.2, 1.21.1

Description

CVSS Score 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, Medium

A crafted request crashes Envoy configured with JWT filter safe_regex match

Impact

Denial of Service (crash)

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

Not use safe_regex for JWT filter

References

https://blog.envoyproxy.io
https://github.com/envoyproxy/envoy/releases

For more information

Open an issue in Envoy repo
Email us at envoy-security

Severity

Moderate

6.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H