CVE-2019-18802 — Improper Access Control in Envoy

CWE-284 — Improper Access Control4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.0%
top 86.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Envoyproxy Envoy
Timeline
PublishedDec 13
Latest updateMay 24

Description

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDenvoyproxy/envoy1.12.1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-fx83-72pw-c56f: An issue was discovered in Envoy 1↗2022-05-24
▶

📋Vendor Advisories

1
Red Hat
envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure↗2019-12-10
▶

💬Community

1
Bugzilla
CVE-2019-18802 envoy: malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure↗2019-11-18
▶
CVE-2019-18802 — Improper Access Control in Envoy | cvebase