BIT-envoy-2020-25017

vendorUSosv

view advisory published 2024-03-06Licence: per source

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-25017US	high8.3	1.32% (71st)	—	2020-10-01
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing oc…

references

External citations — patches, advisories, analysis.

https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4wADVISORY
https://groups.google.com/forum/#%21forum/envoy-security-announceWEB
https://nvd.nist.gov/vuln/detail/CVE-2020-25017WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan