PT-2020-15892 · Envoy · Envoy

Harvey Tuch + 3 · Published 2020-10-01 · Updated 2024-03-06 · CVE-2020-25017

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.15.0

Description The issue arises because Envoy only considers the first value when multiple header values are present for some HTTP headers. Additionally, Envoy's setCopy() header map API does not replace all existing occurrences of a non-inline header.

Recommendations For versions prior to 1.15.0, update to version 1.15.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the setCopy() header map API to minimize the risk of exploitation. Avoid using non-inline headers in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

BIT-ENVOY-2020-25017

CVE-2020-25017

GHSA-2V25-CJJQ-5F4W

RHSA-2020:4129

Affected Products

Envoy

References · 5

• 🔥 https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w · Exploit
• https://osv.dev/vulnerability/BIT-envoy-2020-25017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25017 · Security Note
• https://groups.google.com/forum/#%21forum/envoy-security-announce · Note