Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-12603

Опубликовано: 30 июн. 2020
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

A flaw was found in Envoy in versions through 1.14.1. An excessive amount of memory may be consumed when proxying HTTP/2 requests and responses that contain many small (e.g. 1 byte) data frames. The highest threat from this vulnerability is to system availability.

Отчет

A uncontrolled resource consumption vulnerability was found in Envoy. An attacker could craft many HTTP/2 requests (or responses) with very small data frames, to cause the proxy to consume excessive amounts of memory potentially resulting in a denial of service.

Дополнительная информация

Статус:

Important
Дефект:
CWE-400
https://bugzilla.redhat.com/show_bug.cgi?id=1844251envoy: Resource exhaustion when proxying HTTP/2 requests or responses with small data frames

EPSS

Процентиль: 73%
0.00786
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 7.5
nvd
больше 5 лет назад

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

CVSS3: 7.5
debian
больше 5 лет назад

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive ...

suse-cvrf
почти 4 года назад

Security update for envoy-proxy

EPSS

Процентиль: 73%
0.00786
Низкий

7.5 High

CVSS3