CVE-2020-25017: High severity envoy proxy vulnerability
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-25017?
CVE-2020-25017 is a vulnerability in Envoy through version 1.15.0 that only considers the first value when multiple header values are present for some HTTP headers.
How does the vulnerability in CVE-2020-25017 affect Envoy?
The vulnerability in CVE-2020-25017 affects Envoy through version 1.15.0 by not replacing all existing occurrences of a non-inline header when using Envoy's setCopy() header map API.
What is the severity of CVE-2020-25017?
The severity of CVE-2020-25017 is rated as high, with a CVSS score of 8.3.
Which software versions are affected by CVE-2020-25017?
Envoy versions 1.12.7, 1.13.0 to 1.13.4, 1.14.0 to 1.14.4, and 1.15.0 to 1.15.1 are affected by CVE-2020-25017.
How can I find more information about CVE-2020-25017?
You can find more information about CVE-2020-25017 on the Envoyproxy GitHub repository and the Envoy Security Announce Google Group.