VDB
CVE-2019-9900
CVE-2019-9900
PUBLISHED
CVSS 6.5 MEDIUM
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.
EPSS 3.73% · 89.5th percentile
Risk Scores
CVSS 3.0
6.5
CVSS:3.0/AC:H/AV:N/A:L/C:L/I:L/PR:N/S:C/UI:N
EPSS Score
3.73%
89.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| envoyproxy | envoy | 0 |
| redhat | openshift_service_mesh | |
| n/a | n/a | n/a |
Timeline
- CVE Published
- Feb 13, 2020 PoC Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Sep 6, 2022 EPSS Score
References
- https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history url
- https://groups.google.com/forum/#%21topic/envoy-announce/VoHfnDqZiAM url
- RHSA-2019:0741 vendor-advisory
- https://github.com/envoyproxy/envoy/issues/6434 url
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-x74r-f4mw-c32h url
- https://nvd.nist.gov/vuln/detail/CVE-2019-9900 advisory
- https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM url