CVE-2019-15226

{"id": "CVE-2019-15226", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-10-09T16:15:14.687", "references": [{"url": "https://github.com/envoyproxy/envoy/commit/afc39bea36fd436e54262f150c009e8d72db5014", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/envoyproxy/envoy/commits/master", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/envoyproxy/envoy/issues/8520", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. The implementation in versions 1.10.0 through 1.11.1 for HTTP/1.x traffic and all versions of Envoy for HTTP/2 traffic had O(n^2) performance characteristics. A remote attacker may craft a request that stays below the maximum request header size but consists of many thousands of small headers to consume CPU and result in a denial-of-service attack."}, {"lang": "es", "value": "Al recibir los datos de cada encabezado de petici\u00f3n entrante, Envoy iterar\u00e1 sobre los encabezados de petici\u00f3n existentes para comprobar que el tama\u00f1o total de los encabezados permanezca por debajo del l\u00edmite m\u00e1ximo. La implementaci\u00f3n en las versiones 1.10.0 hasta 1.11.1 para el tr\u00e1fico HTTP/1.x y todas las versiones de Envoy para el tr\u00e1fico HTTP/2 ten\u00edan caracter\u00edsticas de rendimiento O(n^2). Un atacante remoto puede crear una petici\u00f3n que se mantenga por debajo del tama\u00f1o m\u00e1ximo del encabezado de la petici\u00f3n, pero que consista en muchos miles de encabezados peque\u00f1os para consumir la CPU y resultar en un ataque de denegaci\u00f3n de servicio."}], "lastModified": "2019-10-17T17:03:07.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A41CDE9-4AEA-4D10-B8AB-464DD392CDB9"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0DB36A7-0053-45BE-A0E1-CEA00E3E19A6"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA462017-5394-43F8-96ED-0EE177FE0873"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E80A9D3-D22E-4BE4-BAD7-BC56EF40A2F4"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5127853B-821C-47C6-9A25-76E9E66EE804"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "684F3C83-3F67-4D04-8CF0-A6038C7BF84A"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC08C225-35BC-40BB-BFA4-9029ACB64F69"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF0082A6-4495-41FD-83F4-7FFC7CBD68C1"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E55D00E-7B40-4CB9-A22B-979851493EC0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A690019F-9ACC-4054-B886-2FB7D66B9965"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF8A839E-09A8-40C0-837B-C4096F7194A9"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1677F01F-0112-41FF-B2DF-0DC8C2C4D8EF"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87EF5304-3318-436B-B13B-0697DA591A20"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DC9B252-E49B-4D80-814B-3CC932CC64AC"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68F07BA5-07C7-4630-95AD-E40600B9BD1B"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D020CF31-4608-4917-AC10-C90B60BEC91C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}