4.3
Moyenne
CVE-2025-0754 The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6
Description
The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenShift Service Mesh 2 | Versions non publiées |
Références
- access.redhat.com access.redhat.com
- RHBZ#2339147 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de OpenShift Service Mesh 2
Les 45 CVE de OpenShift Service Mesh 2 →
CVE-2026-47220
Envoy is an open source edge and service proxy designed for cloud-native applications
7.5
Élevée
CVE-2026-27145
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name…
6.5
Moyenne
CVE-2024-52011
launch-editor allows users to open files with line numbers in editor from Node.js
7.5
Élevée
CVE-2026-45736
ws is an open source WebSocket client and server for Node.js
4.4
Moyenne