CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35471
https://notcve.org/view.php?id=CVE-2020-35471
Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 1500. Envoy versiones anteriores a 1.16.1, maneja inapropiadamente datagramas perdidos y truncados, como es demostrado por un fallo de segmentación para un tamaño de paquete UDP más largo que 1500 • https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 https://github.com/envoyproxy/envoy/issues/14113 https://github.com/envoyproxy/envoy/pull/14122 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-25018
https://notcve.org/view.php?id=CVE-2020-25018
Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization. Envoy master versiones entre 2d69e30 y 3b5acb2, puede presentar un fallo al analizar una URL de petición que requiere la canonicalización del host • https://github.com/envoyproxy/envoy/security/advisories/GHSA-fwwh-fc9w-9673 https://groups.google.com/forum/#%21forum/envoy-security-announce •
CVSS: 8.3EPSS: 0%CPEs: 4EXPL: 1CVE-2020-25017 – envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests
https://notcve.org/view.php?id=CVE-2020-25017
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header. Envoy versiones hasta 1.15.0, solo considera el primer valor cuando múltiples valores de encabezado están presentes para algunos encabezados HTTP. La API de mapa de encabezado de la función setCopy() de Envoy no reemplaza todas las ocurrencias existentes de un encabezado no en línea An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w https://groups.google.com/forum/#%21forum/envoy-security-announce https://access.redhat.com/security/cve/CVE-2020-25017 https://bugzilla.redhat.com/show_bug.cgi?id=1877613 • CWE-284: Improper Access Control •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15104 – TLS Validation Vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2020-15104
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg https://access.redhat.com/security/cve/CVE-2020-15104 https://bugzilla.redhat.com/show_bug.cgi?id=1856232 • CWE-297: Improper Validation of Certificate with Host Mismatch CWE-346: Origin Validation Error •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12605 – envoy: Resource exhaustion when processing HTTP/1.1 headers with long field names
https://notcve.org/view.php?id=CVE-2020-12605
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs. Envoy versiones 1.14.2, 1.13.2, 1.12.4 o anteriores, puede consumir cantidades excesivas de memoria cuando se procesan encabezados HTTP/1.1 con nombres de campo largos o peticiones con las URL largas An uncontrolled resource consumption vulnerability was found in Envoy. This flaw allows an attacker to craft many HTTP requests with long field names or URLs to cause the proxy to consume excessive amounts of memory, potentially resulting in a denial of service. The highest threat from this vulnerability is to system availability. • https://github.com/envoyproxy/envoy-setec/issues/137 https://github.com/envoyproxy/envoy/security/advisories/GHSA-fjxc-jj43-f777 https://access.redhat.com/security/cve/CVE-2020-12605 https://bugzilla.redhat.com/show_bug.cgi?id=1844252 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •