PT-2020-17336 · Envoy · Envoy

Abergmann · Published 2020-12-15 · Updated 2024-03-06 · CVE-2020-35470

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.16.1

Description The issue arises when Envoy logs an incorrect downstream address, considering only the directly connected peer and not the information in the proxy protocol header. This specifically affects situations where tcp-proxy is used as the network filter, excluding HTTP filters.

Recommendations For versions prior to 1.16.1, update to version 1.16.1 or later to resolve the issue. As a temporary workaround, consider configuring the logging mechanism to account for the proxy protocol header information until a patch is applied. Restrict access to the tcp-proxy network filter to minimize the risk of incorrect logging.

Fix

Related Identifiers

BIT-ENVOY-2020-35470

CVE-2020-35470

Affected Products

Envoy

References · 9

• https://github.com/envoyproxy/envoy/issues/14087 · Patch
• https://github.com/envoyproxy/envoy/pull/14131 · Patch
• https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-35470 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2020-35470 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35470 · Vendor Advisory
• https://t.me/cibsecurity/20798 · Telegram Post
• https://t.me/cvenotify/7097 · Telegram Post
• https://t.me/cvenotify/7084 · Telegram Post