Red Hat Security Advisory

RHSA-2019:0741

Istio-Proxy Security Update

Released 2019-04-10 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2019-07277 CVE-2019-9901 · GHSA-2wmf-p7f8-w42h

MEDIUM 51

Envoy 1.9.0 and before does not normalize HTTP URL paths.

CVSS 3.0CRITICAL 10.0 Network No auth No interaction EPSS 0.04951 Published 2019-04-25 Fixed in 1.9.1 CWE-706

TI-2019-07276 CVE-2019-9900 · GHSA-h9r7-c397-3wqr

MEDIUM 42

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0).

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.03732 Published 2019-04-25 Fixed CWE-74