Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2020-35470

Опубликовано: 21 нояб. 2020
Источник: redhat
CVSS3: 8.8

Описание

Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
OpenShift Service Mesh 1servicemesh-proxyNot affected
OpenShift Service Mesh 2.0servicemesh-proxyNot affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-284
https://bugzilla.redhat.com/show_bug.cgi?id=1907805envoy: logs incorrect downstream address making it possible to bypass the RBAC policy

8.8 High

CVSS3

Связанные уязвимости

CVSS3: 8.8
nvd
около 5 лет назад

Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).

CVSS3: 8.8
debian
около 5 лет назад

Envoy before 1.16.1 logs an incorrect downstream address because it co ...

github
больше 3 лет назад

Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).

8.8 High

CVSS3