Bug 1698020 (CVE-2019-9900)

Summary:	CVE-2019-9900 istio/envoy: Authorization bypass via null characters injection in HTTP/1.x
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bavery, kconner, mcooper, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Envoy version 1.9.0 and older, where Envoy does not reject embedded zero characters (NUL, ASCII 0x0) when processing HTTP/1.x header values. This flaw allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-13 04:31:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1698026

Description Pedro Sampaio 2019-04-09 13:02:14 UTC

A flaw was found in Envoy 1.9.0 and older. When parsing HTTP/1.x header values, Envoy does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

Upstream issue:

https://github.com/envoyproxy/envoy/issues/6434

References:

https://istio.io/blog/2019/announcing-1.1.2/

Comment 1 Pedro Sampaio 2019-04-09 13:02:17 UTC

Acknowledgments:

Name: the Envoy security team

Comment 3 errata-xmlrpc 2019-04-10 20:29:12 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh Tech Preview

Via RHSA-2019:0741 https://access.redhat.com/errata/RHSA-2019:0741

Comment 4 Product Security DevOps Team 2020-03-13 04:31:43 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-9900