Envoy up to 1.16.4/1.17.3/1.18.3/1.19.0 Local Response use after free

Summaryinfo

A vulnerability has been found in Envoy up to 1.16.4/1.17.3/1.18.3/1.19.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Local Response Handler. Performing a manipulation results in use after free. This vulnerability is identified as CVE-2021-32781. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Envoy up to 1.16.4/1.17.3/1.18.3/1.19.0. It has been classified as problematic. This affects an unknown part of the component Local Response Handler. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on availability.

The weakness was released 08/25/2021. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2021-32781. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.16.5, 1.17.4, 1.18.4 or 1.19.1 eliminates this vulnerability. The upgrade is hosted for download at envoyproxy.io.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Envoy

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.16.0
• 1.16.1
• 1.16.2
• 1.16.3
• 1.16.4
• 1.17
• 1.17.0
• 1.17.1
• 1.17.2
• 1.17.3
• 1.18
• 1.18.0
• 1.18.1
• 1.18.2
• 1.18.3
• 1.19.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion