CVE-2020-12604: High severity envoy proxy vulnerability

Q: What is CVE-2020-12604?

CVE-2020-12604 is a vulnerability in Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier that can result in increased memory usage when an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

Q: How severe is CVE-2020-12604?

CVE-2020-12604 has a severity value of 7.5 (high).

Q: Which software versions are affected by CVE-2020-12604?

Envoy versions 1.14.2, 1.13.2, 1.12.4 or earlier are affected by CVE-2020-12604.

Q: How can I fix CVE-2020-12604?

To fix CVE-2020-12604, upgrade your Envoy installation to a version later than 1.12.4, 1.13.2, or 1.14.2.

Q: Where can I find more information about CVE-2020-12604?

You can find more information about CVE-2020-12604 on the GitHub page of Envoyproxy Envoy and the related security advisory.

Published Jul 1, 2020

Updated

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

Affected Software

3 affected components

Envoyproxy Envoy<=1.12.4

Envoyproxy Envoy=1.13.2

Envoyproxy Envoy=1.14.2

Remediation

Patch Available

https://github.com/envoyproxy/envoy/commits/master

Event History

Jul 1, 2020

CVE Published

via MITRE·02:24 PM

Data Sourced

via MITRE·02:24 PM

Description

Frequently Asked Questions

What is CVE-2020-12604?

CVE-2020-12604 is a vulnerability in Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier that can result in increased memory usage when an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

How severe is CVE-2020-12604?