CVE-2020-25017

Description

An incorrect access control bypass vulnerability was found in envoy proxy/envoy. This flaw allows an attacker to send multiple HTTP headers where only the first one is valid. Envoy then forwards all of the headers as valid to the upstream component. This issue allows an attacker to subvert any envoy filters or rules, causing an inconsistency between envoy and the upstream component, potentially gaining access to restricted resources.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score8.38.3N/A
Attack VectorNetworkNetworkN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionNoneNoneN/A
ScopeChangedChangedN/A
ConfidentialityLowLowN/A
Integrity ImpactLowLowN/A
Availability ImpactLowLowN/A

Vector

Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Red Hat CVSS v3 Score Explanation

Proposed changes to NIST's current CVSSv3 scoring:

S:U -> S:C An exploited vulnerability can affect various resources, also these beyond the security scope managed by the security authority of the vulnerable component. Hence proposing a change to Scope (S) metric from Unchanged to Changed. The same value to this metric has been assigned by Upstream.

We consider this as a Moderate impact flaw.

Understanding the Weakness (CWE)

CWE-284

Other

Technical Impact: Varies by Context

Acknowledgements

Red Hat would like to thank the Envoy security team for reporting this issue.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.