Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path,
    e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then
    interpret the non-normalized path and provide an attacker access beyond the scope provided for by the
    access control policy. (CVE-2019-9901)

An update of the envoy package has been released.

Istio reports :

Two security vulnerabilities have recently been identified in the Envoy proxy. The vulnerabilities are centered on the fact that Envoy did not normalize HTTP URI paths and did not fully validate HTTP/1.1 header values. These vulnerabilities impact Istio features that rely on Envoy to enforce any of authorization, routing, or rate limiting.

An update for Istio-Proxy is now available for Red Hat OpenShift Service Mesh Tech Preview 0.9.0.

Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

Security fix(es) :

* istio-proxy: CVE-2019-9901 istio/envoy: Path traversal via URL Patch manipulation in HTTP/1.x header. (CVE-2019-9900)

* istio-proxy: CVE-2019-9900 istio/envoy: Authorization bypass via null characters injection in HTTP/1.x (CVE-2019-9901)

For more details about the security issue(s), including the impact, a CVSS score,acknowledgements, and other related information, refer to the CVE page(s) listed in the References section.

ID	Name	Product	Family	Severity
433726	SCA: security update for github.com/envoyproxy/envoy (GHSA-2wmf-p7f8-w42h)	Tenable Cloud Security	SCA Checks	critical
433726	SCA: security update for github.com/envoyproxy/envoy (GHSA-2wmf-p7f8-w42h)	Tenable Self-Hosted Container Security	SCA Checks	critical
203092	Photon OS 2.0: Envoy PHSA-2019-2.0-0159	Nessus	PhotonOS Local Security Checks	critical
126478	Photon OS 1.0: Envoy PHSA-2019-1.0-0241	Nessus	PhotonOS Local Security Checks	critical
124220	FreeBSD : Istio -- Security vulnerabilities (484d3f5e-653a-11e9-b0e3-1c39475b9f84)	Nessus	FreeBSD Local Security Checks	critical
124049	RHEL 7 : openshift (RHSA-2019:0741)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2019-9901

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical