CVE-2019-9900
First published: Tue Apr 09 2019(Updated: )
A flaw was found in Envoy 1.9.0 and older. When parsing HTTP/1.x header values, Envoy does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources. Upstream issue: <a href="https://github.com/envoyproxy/envoy/issues/6434">https://github.com/envoyproxy/envoy/issues/6434</a> References: <a href="https://istio.io/blog/2019/announcing-1.1.2/">https://istio.io/blog/2019/announcing-1.1.2/</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoyproxy Envoy | <=1.9.0 | |
| Redhat Openshift Service Mesh |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/envoyproxy/envoy/issues/6434
- https://istio.io/blog/2019/announcing-1.1.2/
- https://access.redhat.com/errata/RHSA-2019:0741
- https://access.redhat.com/security/cve/cve-2019-9900
- https://bugzilla.redhat.com/show_bug.cgi?id=1698020
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h
- https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM
- https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history
Frequently Asked Questions
What is CVE-2019-9900?
CVE-2019-9900 is a vulnerability in Envoy 1.9.0 and earlier that allows remote attackers to potentially bypass header matching rules.
How does CVE-2019-9900 affect EnvoyProxy Envoy?
CVE-2019-9900 affects EnvoyProxy Envoy versions up to and including 1.9.0.
What is the severity of CVE-2019-9900?
CVE-2019-9900 has a severity rating of 8.3 (high).
How can remote attackers exploit CVE-2019-9900?
Remote attackers can craft header values with embedded NUL characters to potentially bypass header matching rules and gain unauthorized access to resources.
How can I fix CVE-2019-9900 vulnerability?
To fix the CVE-2019-9900 vulnerability, upgrade EnvoyProxy Envoy to a version later than 1.9.0.
- collector/redhat-bugzilla
- alias/CVE-2019-9900
- collector/nvd-index
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- vendor/envoyproxy
- canonical/envoyproxy envoy
- version/envoyproxy envoy/1.9.0
- vendor/redhat
- canonical/redhat openshift service mesh