CVSS: 8.3EPSS: 0%CPEs: 4EXPL: 1CVE-2020-25017 – envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests
https://notcve.org/view.php?id=CVE-2020-25017
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header. Envoy versiones hasta 1.15.0, solo considera el primer valor cuando múltiples valores de encabezado están presentes para algunos encabezados HTTP. La API de mapa de encabezado de la función setCopy() de Envoy no reemplaza todas las ocurrencias existentes de un encabezado no en línea An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w https://groups.google.com/forum/#%21forum/envoy-security-announce https://access.redhat.com/security/cve/CVE-2020-25017 https://bugzilla.redhat.com/show_bug.cgi?id=1877613 • CWE-284: Improper Access Control •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2020-15104 – TLS Validation Vulnerability in Envoy
https://notcve.org/view.php?id=CVE-2020-15104
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg https://access.redhat.com/security/cve/CVE-2020-15104 https://bugzilla.redhat.com/show_bug.cgi?id=1856232 • CWE-297: Improper Validation of Certificate with Host Mismatch CWE-346: Origin Validation Error •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12605 – envoy: Resource exhaustion when processing HTTP/1.1 headers with long field names
https://notcve.org/view.php?id=CVE-2020-12605
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs. Envoy versiones 1.14.2, 1.13.2, 1.12.4 o anteriores, puede consumir cantidades excesivas de memoria cuando se procesan encabezados HTTP/1.1 con nombres de campo largos o peticiones con las URL largas An uncontrolled resource consumption vulnerability was found in Envoy. This flaw allows an attacker to craft many HTTP requests with long field names or URLs to cause the proxy to consume excessive amounts of memory, potentially resulting in a denial of service. The highest threat from this vulnerability is to system availability. • https://github.com/envoyproxy/envoy-setec/issues/137 https://github.com/envoyproxy/envoy/security/advisories/GHSA-fjxc-jj43-f777 https://access.redhat.com/security/cve/CVE-2020-12605 https://bugzilla.redhat.com/show_bug.cgi?id=1844252 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-12604 – envoy: Resource exhaustion via HTTP/2 client requests with large payloads and improper stream windows
https://notcve.org/view.php?id=CVE-2020-12604
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream. Envoy versiones 1.14.2, 1.13.2, 1.12.4 o anteriores, es susceptible a incrementar un uso de memoria en el caso en que un cliente HTTP/2 solicita una gran carga útil pero no envía suficientes actualizaciones de ventana para consumir toda la transmisión de datos y no se reinicia la transmisión de datos • https://github.com/envoyproxy/envoy/commits/master https://github.com/envoyproxy/envoy/security/advisories/GHSA-8hf8-8gvw-ggvx https://access.redhat.com/security/cve/CVE-2020-12604 https://bugzilla.redhat.com/show_bug.cgi?id=1844255 • CWE-400: Uncontrolled Resource Consumption CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8663 – envoy: Resource exhaustion when accepting too many connections
https://notcve.org/view.php?id=CVE-2020-8663
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. Envoy versión 1.14.2, 1.13.2, 1.12.4 o anteriores, puede agotar los descriptores de archivo y/o memoria al aceptar demasiadas conexiones A flaw was found in envoy in versions through 1.14.1. Accepting too many connections may lead to an exhaustion of file descriptors and/or memory. The highest threat from this vulnerability is to system availability. • https://github.com/envoyproxy/envoy/security/advisories/GHSA-v8q7-fq78-4997 https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history https://access.redhat.com/security/cve/CVE-2020-8663 https://bugzilla.redhat.com/show_bug.cgi?id=1844254 • CWE-400: Uncontrolled Resource Consumption •