CVE-2020-12603

mediumPriorität · verfolgen · 31EPSS 0.014 · 73. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.45% (73rd) EPSS
CVSS 5 · medium
Is it mine?
18 products
Prüfe deine Angriffsfläche
Who says so?
6 sources
cnnvd · enisa_euvd · osv · cert_bund

EPSS · bewertet 2026-10-27

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behobenservicemesh-proxy-0:1.1.4-2.el8.src as a component of OpenShift Service Mesh 1.1redhat_csaf

    The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html

    https://access.redhat.com/errata/RHSA-2020:2798
  • Behobenservicemesh-proxy-0:1.1.4-2.el8.x86_64 as a component of OpenShift Service Mesh 1.1redhat_csaf

    The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html

    https://access.redhat.com/errata/RHSA-2020:2798
  • Behobenservicemesh-proxy-0:1.0.11-1.el8.src as a component of OpenShift Service Mesh 1.0redhat_csaf

    The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html

    https://access.redhat.com/errata/RHSA-2020:2864
  • Behobenservicemesh-proxy-0:1.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 1.0redhat_csaf

    The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html

    https://access.redhat.com/errata/RHSA-2020:2864
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · Red Hat Product Security US
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-400USprimärCWE-400US
04

betroffene Produkte (18)

Betroffene Produkte und Versionsbereiche.

05

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2020:2798Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy security update2020-07-01csaf · redhat_csafUS

    An update for servicemesh-proxy is now available for OpenShift Service Mesh 1.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2020:2864Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy security update2020-07-07csaf · redhat_csafUS

    An update for servicemesh-proxy is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • WID-SEC-W-2026-0777Red Hat OpenShift: Mehrere SchwachstellenDeutsch2020-07-01csaf · cert_bundDE

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen, beliebigen Programmcode auszuführen, oder Auswirkungen hinsichtlich der Vertraulichkeit, Verfügbarkeit und Integrität zu verursachen.

  • BIT-envoy-2020-126032024-03-06vendor · osvUS

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdosvcert_bundnvdredhat_csafNVDCVE.orgMITRE
veröffentlicht 2020-07-01geändert 2026-06-17
09

Referenzen (15)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan