CVE-2022-29225 Zip bomb vulnerability in Envoy
Attackers can cause denial of service in Envoy proxy by sending highly compressed payloads that exhaust system memory during decompression.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29225?
CVE-2022-29225 is a high-severity denial of service vulnerability in Envoyproxy Envoy, published on 9 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload. Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are advised to upgrade. Users unable to upgrade may consider disabling decompression.
Which versions are affected by CVE-2022-29225?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.22.1 |
Products include Envoyproxy Envoy.
How do I fix CVE-2022-29225?
Upgrade envoy to 1.22.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-29225 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-29225 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2022-29225, GHSA-75hv-2jjj-89hh.