high8.3
CVE-2020-25017
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers.
Impact
Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Envoyproxy | Envoy | before 1.12.7 from 1.13.0 before 1.13.4 from 1.14.0 before 1.14.4 from 1.15.0 before 1.15.1 |
References
- NVD record
- CVE.org record
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w
- https://groups.google.com/forum/#%21forum/envoy-security-announce
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-2v25-cjjq-5f4w
- https://groups.google.com/forum/#%21forum/envoy-security-announce