PT-2020-5132 · Cncf · Envoy

Wenlei He · Published 2020-03-04 · Updated 2022-09-30 · CVE-2020-8659

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions CNCF Envoy versions 1.13.0 and earlier

Description The issue is related to excessive memory consumption when proxying HTTP/1.1 requests or responses with many small chunks. This can be exploited by a remote attacker to cause a denial of service. The problem is associated with an uncontrolled resource consumption in the Envoy network software.

Recommendations For versions 1.13.0 and earlier, consider updating to a version that fixes the memory consumption issue to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

BDU:2020-05728

CVE-2020-8659

DLA-3014-1

GHSA-JWCM-4PWP-C2QV

RHSA-2020:0734

Affected Products

Envoy

References · 10

• https://osv.dev/vulnerability/DLA-3014-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8659 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8659 · Security Note
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv · Note
• https://envoyproxy.io/docs/envoy/v1.13.1/intro/version_history · Note
• https://t.me/cvenotify/1335 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html · Note
• https://access.redhat.com/security/cve/cve-2020-8659 · Note