CVE-2019-18802
published 2019-12-13CVE-2019-18802: An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will…
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.46%
82.4th percentile
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | <= 1.12.1 | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure
vendor_redhat·2019-12-10·CVSS 9.8
CVE-2019-18802 [CRITICAL] CWE-284 envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure
envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
A flaw was found in envoy. A malformed request header may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
GHSA
GHSA-fx83-72pw-c56f: An issue was discovered in Envoy 1
ghsa_unreviewed·2022-05-24
CVE-2019-18802 [CRITICAL] GHSA-fx83-72pw-c56f: An issue was discovered in Envoy 1
An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.htmlhttps://blog.envoyproxy.iohttps://github.com/envoyproxy/envoy/commits/masterhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4https://groups.google.com/forum/#%21forum/envoy-usershttp://lists.opensuse.org/opensuse-security-announce/2020-03/msg00034.htmlhttps://blog.envoyproxy.iohttps://github.com/envoyproxy/envoy/commits/masterhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4https://groups.google.com/forum/#%21forum/envoy-users
2019-12-13
Published