Published: 25/04/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 8.3 | Impact Score: 3.7 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

Vulnerable Product	Search on Vulmon	Subscribe to Product
envoyproxy envoy
redhat openshift service mesh -

Synopsis Important: Istio-Proxy Security Update Type/Severity Security Advisory: Important Topic An update for Istio-Proxy is now available for Red Hat OpenShift Service Mesh Tech Preview 090Red Hat Product Security has rated this update as having a security impact ofimportant A Common Vulnerability Sco ...

How to use this tool? If envoy is in your path, Simply run it! $ envoy-cves ✔ Success! your envoy was tested and is immune to CVE-2019-9901 Make sure that the option normalize_path is turned on in your HCM settings ✔ Success! your envoy was tested and is immune to CVE-2019-9900 If not, provide the path to envoy in a flag: envoy-cves

CWE-74 https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history https://github.com/envoyproxy/envoy/issues/6434 https://access.redhat.com/errata/RHSA-2019:0741 https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM https://access.redhat.com/errata/RHSA-2019:0741 https://nvd.nist.gov

CVE-2019-9900

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect