« Volver al listado

CVE-2021-28682

Estado: ModificadaAlta (7.5)—

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Envoyproxy — Envoy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-28682",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-20T17:15:07.680",
  "references": [
    {
      "url": "https://blog.envoyproxy.io",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/envoyproxy/envoy/releases",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-r22g-5f3x-xjgg",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "https://blog.envoyproxy.io",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/envoyproxy/envoy/blob/15e3b9dbcc9aaa9d391fa8033904aad1ea1ae70d/api/envoy/api/v2/cluster.proto#L36",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/envoyproxy/envoy/releases",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Envoy versiones hasta 1.71.1. presenta un desbordamiento de enteros explotable remoto en el que un valor de grpc-timeout muy grande conlleva a cálculos de tiempo de espera inesperados"
    }
  ],
  "lastModified": "2026-06-17T03:46:47.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:1.14.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3DBF84E-6E48-4EBD-AC66-E345063B521F"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:1.15.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B87350B3-58D6-4A1E-8A4A-8846D65070CE"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:1.16.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "065415B4-0F56-4AE3-B17D-B38416543DDC"
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:1.17.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA926D71-E8B2-40D9-9D44-CAC09EB4FCA4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}