CVE-2019-18802 (High) detected in envoy-wasmae02dc6bdd5c5ea61c3869395d81689e34988156

[mend-bolt-for-github]

CVE-2019-18802 - High Severity Vulnerability

Vulnerable Library - envoy-wasmae02dc6bdd5c5ea61c3869395d81689e34988156

*ATTENTION!: The content of this repo is merged into https://github.com/envoyproxy/envoy and future development is happening there.

Library home page: https://github.com/envoyproxy/envoy-wasm.git

Found in HEAD commit: 320650059a0b0796f39380aaca16815f2f8a4625

Found in base branch: master

Vulnerable Source Files (1)

envoy/source/common/runtime/runtime_features.cc

Vulnerability Details

An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitespace after the header content. Envoy will treat "header-value " as a different string from "header-value" so for example with the Host header "example.com " one could bypass "example.com" matchers.

Publish Date: 2019-12-13

URL: CVE-2019-18802

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18802

Release Date: 2019-12-13

Fix Resolution: 1.12.2

---

Step up your Open Source Security Game with WhiteSource here