CVE-2019-9900

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
mitreCNA
6.5 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
VendorProductVersion
envoyproxyenvoy
𝑥
≤ 1.9.0
redhatopenshift_service_mesh
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2019:0741
https://github.com/envoyproxy/envoy/issues/6434
https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h
https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history
https://access.redhat.com/errata/RHSA-2019:0741
https://github.com/envoyproxy/envoy/issues/6434
https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h
https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM
https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history