When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
How to use this tool? If envoy is in your path, Simply run it! $ envoy-cves ✔ Success! your envoy was tested and is immune to CVE-2019-9901 Make sure that the option normalize_path is turned on in your HCM settings ✔ Success! your envoy was tested and is immune to CVE-2019-9900 If not, provide the path to envoy in a flag: envoy-cves --envoy=/path/to/envoy ✘ Fail! your