SB2020070147 - Multiple vulnerabilities in envoy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020070147

SB2020070147 - Multiple vulnerabilities in envoy

Published: July 1, 2020 Updated: August 8, 2020

Security Bulletin ID SB2020070147
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2020-12604)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.


2) Resource exhaustion (CVE-ID: CVE-2020-12605)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.


3) Resource exhaustion (CVE-ID: CVE-2020-12603)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.


Remediation

Install update from vendor's website.

References