‼ CVE-2022-23606 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0654 ‼
📖 Read
via "National Vulnerability Database".
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43824 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21654 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43825 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21657 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43826 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21655 ‼
📖 Read
via "National Vulnerability Database".
Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.📖 Read
via "National Vulnerability Database".
📢 Novel phishing method deceives users with ubiquitous IT support tool 📢
📖 Read
via "ITPro".
The man-in-the-middle attack can be used for a range of nefarious purposes, including credential theft and malicious code injection📖 Read
via "ITPro".
IT PRO
Novel phishing method deceives users with ubiquitous IT support tool | IT PRO
The man-in-the-middle attack can be used for a range of nefarious purposes, including credential theft and malicious code injection
📢 Hackers caught dropping malware into Microsoft Teams chats 📢
📖 Read
via "ITPro".
The self-administering files can take complete control of a user's system after a single click📖 Read
via "ITPro".
ITPro
Hackers caught dropping malware into Microsoft Teams chats
The self-administering files can take complete control of a user's system after a single click
📢 Cisco patches bug that could break its email security service with a single message 📢
📖 Read
via "ITPro".
A carefully crafted email could freeze Cisco's Email Security Appliance interface and stop it processing messages📖 Read
via "ITPro".
IT PRO
Cisco patches bug that could break its email security service with a single message | IT PRO
A carefully crafted email could freeze Cisco's Email Security Appliance interface and stop it processing messages
📢 UK, US officials say Russia was behind DDoS attacks against Ukraine 📢
📖 Read
via "ITPro".
The Russian Embassy in the US slammed the accusations as "baseless statements"📖 Read
via "ITPro".
IT PRO
UK, US officials say Russia was behind DDoS attacks against Ukraine | IT PRO
The Russian Embassy in the US slammed the accusations as "baseless statements"
📢 Australian firms reported 464 data breaches in second half of 2021 📢
📖 Read
via "ITPro".
Malicious or criminal attacks remain the leading source of incidents, accounting for 55% of the total📖 Read
via "ITPro".
IT PRO
Australian firms reported 464 data breaches in second half of 2021 | IT PRO
Malicious or criminal attacks remain the leading source of incidents, accounting for 55% of the total
📢 Nokia debuts new SaaS services in security and analytics 📢
📖 Read
via "ITPro".
The offerings accelerate time-to-value while focusing on analytics, security, and monetization📖 Read
via "ITPro".
IT PRO
Nokia debuts new SaaS services in security and analytics | IT PRO
The offerings accelerate time-to-value while focusing on analytics, security, and monetization
📢 GitHub goes open source on security research 📢
📖 Read
via "ITPro".
Community members, enthusiasts, researchers, and academics are now able to submit their own research to widen the understanding of security vulnerabilities📖 Read
via "ITPro".
IT PRO
GitHub goes open source on security research | IT PRO
Community members, enthusiasts, researchers, and academics are now able to submit their own research to widen the understanding of security vulnerabilities
📢 Ten ways to protect your company from the next big data breach 📢
📖 Read
via "ITPro".
Even big-name corporations can’t prevent all breaches, but there are ways to protect your business📖 Read
via "ITPro".
IT PRO
Ten ways to protect your company from the next big data breach | IT PRO
Even big-name corporations can’t prevent all breaches, but there are ways to protect your business
📢 More than 80% of UK businesses paid ransomware demands in 2021 📢
📖 Read
via "ITPro".
The figure means UK organisations are twice as likely to pay a ransom demand compared to the global average📖 Read
via "ITPro".
IT PRO
More than 80% of UK businesses paid ransomware demands in 2021 | IT PRO
The figure means UK organisations are twice as likely to pay a ransom demand compared to the global average
📢 Only ever use black bars to redact text, warns security researcher 📢
📖 Read
via "ITPro".
Researcher Dan Petro shows how pixelation can be easily reversed using algorithms📖 Read
via "ITPro".
IT PRO
Only ever use black bars to redact text, warns security researcher | IT PRO
Researcher Dan Petro shows how pixelation can be easily reversed using algorithms
📢 US pledges to take a 'hands-on' approach to disrupting cyber criminals 📢
📖 Read
via "ITPro".
The country has promised 'proactivity' on cyber warfare as it launches new government cyber crime taskforces📖 Read
via "ITPro".
IT PRO
US pledges to take a 'hands-on' approach to disrupting cyber criminals | IT PRO
The country has promised 'proactivity' on cyber warfare as it launches new government cyber crime taskforces
📢 Why AI and machine learning are vital cybersecurity tools for 2022 📢
📖 Read
via "ITPro".
Matt Aldridge, Principal Solutions Consultant at Carbonite + Webroot, explores how understanding of AI/ML is lagging behind📖 Read
via "ITPro".
IT PRO
Why AI and machine learning are vital cybersecurity tools for 2022 | IT PRO
Matt Aldridge, Principal Solutions Consultant at Carbonite + Webroot, explores how understanding of AI/ML is lagging behind
📢 Adobe forced to patch its own failed security update 📢
📖 Read
via "ITPro".
Company issues new fix for e-commerce vulnerability after researchers bypass the original update📖 Read
via "ITPro".
IT PRO
Adobe forced to patch its own failed security update | IT PRO
Company issues new fix for e-commerce vulnerability after researchers bypass the original update