CRITICAL10.0
GHSA-2wmf-p7f8-w42h
EnvoyProxy Envoy Missing HTTP URL path normalization
Quick fix
GHSA-2wmf-p7f8-w42h — github.com/envoyproxy/envoy: upgrade to the fixed version with the command below.
go get github.com/envoyproxy/envoy@v1.9.1Details
Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/envoyproxy/envoy
Introduced in:
0Fixed in: 1.9.1Fix
go get github.com/envoyproxy/envoy@v1.9.1References
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-xcx5-93pw-jw2w[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2019-9901[ADVISORY]
- https://github.com/envoyproxy/envoy/issues/6435[WEB]
- https://github.com/envoyproxy/envoy/commit/e668e669677e52a00d99652b5a260d1cedafdfa8[WEB]
- https://github.com/envoyproxy/envoy[PACKAGE]
- https://github.com/envoyproxy/envoy/blob/main/security/postmortems/cve-2019-9900.md[WEB]
- https://groups.google.com/forum/#!topic/envoy-announce/VoHfnDqZiAM[WEB]
- https://www.envoyproxy.io/docs/envoy/v1.9.1/intro/version_history[WEB]