PT-2020-20255 · Cncf · Envoy

Alyssa Wilk · Published 2020-03-04 · Updated 2022-05-24 · CVE-2020-8661

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CNCF Envoy versions prior to 1.13.1

Description The issue is related to excessive memory consumption when responding internally to pipelined requests.

Recommendations For versions prior to 1.13.1, update to version 1.13.1 or later to resolve the issue.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-8661

GHSA-36CQ-WW7H-P4J7

RHSA-2020:0734

Affected Products

Envoy

References · 7

• https://osv.dev/vulnerability/CVE-2020-8661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8661 · Security Note
• https://access.redhat.com/errata/RHSA-2020:0734 · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-36cq-ww7h-p4j7 · Note
• https://t.me/cvenotify/30636 · Telegram Post
• https://t.me/cvenotify/1336 · Telegram Post
• https://envoyproxy.io/docs/envoy/v1.13.1/intro/version_history · Note