CVE-2020-12604
mediumPriorität · verfolgen · 31EPSS 0.017 · 77. PerzentilDEEUUSEPSS · bewertet 2026-10-27
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenservicemesh-proxy-0:1.1.4-2.el8.src as a component of OpenShift Service Mesh 1.1redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:2798 - Behobenservicemesh-proxy-0:1.1.4-2.el8.x86_64 as a component of OpenShift Service Mesh 1.1redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:2798 - Behobenservicemesh-proxy-0:1.0.11-1.el8.src as a component of OpenShift Service Mesh 1.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:2864 - Behobenservicemesh-proxy-0:1.0.11-1.el8.x86_64 as a component of OpenShift Service Mesh 1.0redhat_csaf
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:2864
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (18)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- RHSA-2020:2798Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy security update2020-07-01csaf · redhat_csafUS
An update for servicemesh-proxy is now available for OpenShift Service Mesh 1.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- RHSA-2020:2864Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy security update2020-07-07csaf · redhat_csafUS
An update for servicemesh-proxy is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- WID-SEC-W-2026-0777Red Hat OpenShift: Mehrere SchwachstellenDeutsch2020-07-01csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen, beliebigen Programmcode auszuführen, oder Auswirkungen hinsichtlich der Vertraulichkeit, Verfügbarkeit und Integrität zu verursachen.
- BIT-envoy-2020-126042024-03-06vendor · osvUS
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (15)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.nsfocus.net/vulndb/47051cnnvd
- https://access.redhat.com/security/cve/cve-2020-12604cnnvd
- https://github.com/envoyproxy/envoy/commits/mastercnnvd
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-8hf8-8gvw-ggvxcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-12604cnnvd
- https://packetstormsecurity.com/files/158277/Red-Hat-Security-Advisory-2020-2798-01.htmlcnnvd
- https://packetstormsecurity.com/files/158362/Red-Hat-Security-Advisory-2020-2864-01.htmlcnnvd
- https://vigilance.fr/vulnerability/Envoy-four-vulnerabilities-37691cnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan