Projectcontour
Monthly
Lua code injection in Contour (Kubernetes ingress controller for Envoy) from v1.19.0 through the fixes in v1.31.6/v1.32.5/v1.33.4 lets a low-privileged tenant achieve arbitrary code execution inside the shared Envoy proxy. A user with RBAC rights to create or modify HTTPProxy resources injects Lua via the cookie-rewrite pathRewrite.value field; although the code only runs on the attacker's own route, it executes in shared infrastructure and can steal Envoy's xDS credentials (exposing other tenants' TLS keys) or cause denial of service for co-tenants. No public exploit identified at time of analysis, and EPSS is low (0.07%, 22nd percentile), consistent with the requirement for pre-existing cluster RBAC access.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contour is a Kubernetes ingress controller using Envoy proxy. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity.
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Lua code injection in Contour (Kubernetes ingress controller for Envoy) from v1.19.0 through the fixes in v1.31.6/v1.32.5/v1.33.4 lets a low-privileged tenant achieve arbitrary code execution inside the shared Envoy proxy. A user with RBAC rights to create or modify HTTPProxy resources injects Lua via the cookie-rewrite pathRewrite.value field; although the code only runs on the attacker's own route, it executes in shared infrastructure and can steal Envoy's xDS credentials (exposing other tenants' TLS keys) or cause denial of service for co-tenants. No public exploit identified at time of analysis, and EPSS is low (0.07%, 22nd percentile), consistent with the requirement for pre-existing cluster RBAC access.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contour is a Kubernetes ingress controller using Envoy proxy. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity.
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.