PT-2019-15692 · Envoy · Envoy

Oleg Guba · Publicado 2019-12-13 · Atualizado 2019-12-18 · CVE-2019-18838

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Envoy version 1.12.0

Description An issue was discovered where upon receipt of a malformed HTTP request without a Host header, Envoy sends an internally generated "Invalid request" response. This response is dispatched through the configured encoder filter chain before being sent to the client. If an encoder filter invokes route manager APIs that access a request's Host header, it causes a NULL pointer dereference, resulting in abnormal termination of the Envoy process.

Recommendations For Envoy version 1.12.0, consider disabling the encoder filter that invokes route manager APIs until a patch is available to prevent abnormal termination of the Envoy process.

Exploit

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2019-18838

GHSA-F2RV-4W6X-RWHC

RHSA-2019:4222

Produtos afetados

Envoy

Referências · 6

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-f2rv-4w6x-rwhc · Exploit
• https://github.com/envoyproxy/envoy/commits/master · Correção
• https://osv.dev/vulnerability/CVE-2019-18838 · Aviso do Fabricante
• https://blog.envoyproxy.io · Nota
• https://groups.google.com/forum/#%21forum/envoy-users · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-18838 · Nota de Segurança