Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2019-9900

Опубликовано: 05 апр. 2019
Источник: redhat
CVSS3: 8.3
EPSS Низкий

Описание

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

A flaw was found in Envoy version 1.9.0 and older, where Envoy does not reject embedded zero characters (NUL, ASCII 0x0) when processing HTTP/1.x header values. This flaw allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

Дополнительная информация

Статус:

Important
Дефект:
CWE-20
https://bugzilla.redhat.com/show_bug.cgi?id=1698020istio/envoy: Authorization bypass via null characters injection in HTTP/1.x

EPSS

Процентиль: 10%
0.00036
Низкий

8.3 High

CVSS3

Связанные уязвимости

CVSS3: 8.3
nvd
почти 7 лет назад

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

CVSS3: 8.3
github
больше 3 лет назад

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

CVSS3: 8.3
fstec
почти 7 лет назад

Уязвимость сетевого программного средства Envoy, связанная с ошибками при анализе HTTP-заголовков, позволяющая нарушителю получить доступ к защищаемым данным

EPSS

Процентиль: 10%
0.00036
Низкий

8.3 High

CVSS3