SB2019110835 - Multiple vulnerabilities in envoy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019110835

SB2019110835 - Multiple vulnerabilities in envoy

Published: November 8, 2019 Updated: June 24, 2026

Security Bulletin ID SB2019110835
CSH Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2019-9901)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass access control.

The vulnerability exists due to path traversal in RBAC, HTTP router, external authorization, and rate limiting components when handling relative path URLs delivered by an untrusted client. A remote attacker can send a specially crafted request path containing relative path segments to bypass access control.

The issue can also affect routing and authorization decisions when a backend normalizes the path differently than Envoy.


2) Input validation error (CVE-ID: CVE-2019-9900)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to bypass access controls and gain access to unauthorized resources.

The vulnerability exists due to improper input validation in HTTP/1.x header parsing and header matching logic when processing HTTP/1.x requests with header values containing embedded NUL characters. A remote attacker can send a specially crafted HTTP request with embedded NUL characters in header values to bypass access controls and gain access to unauthorized resources.

The issue affects HTTP/1.x traffic and exploitation depends on configurations that use header-based access control, authorization, routing, or rate limiting decisions.


Remediation

Install update from vendor's website.

References