CVE-2020-25017

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-25017
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-25017.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-25017
Aliases
Downstream
Related
  • GHSA-2v25-cjjq-5f4w
Published
2020-10-01T17:15:13.337Z
Modified
2026-02-03T07:09:47.254574Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
[none]
Details

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
50ef0945fa2c5da4bff7627c3abf41fdd3b7cffd
Fixed
670a4a60080f5889d9f7c022a009dcf25f1062ca
Introduced
bb7ceff4c3c5bd4555dff28b6e56d27f2f8be0a7
Fixed
74c221751138e5add71e0738d40092434b76a7cf
Introduced
de12027c9c2de685d85cf1bf0db58280ac06d0a3
Fixed
923c4111bb48405ac96ef050c4f59ebbad3d7761
Fixed
dde2499848f95908cc5c8c9735760cbf0458c645

Affected versions

v1.*
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.15.0

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "target": {
            "file": "source/common/runtime/runtime_features.cc"
        },
        "id": "CVE-2020-25017-2e18951b",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "337794905070803939227931734975121996173",
                "202744723883745882325722813226801796850",
                "307403683100710314007766550973930935129",
                "71576635782893112794958766841295732193"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc",
            "function": "ContextImpl::dnsNameMatch"
        },
        "id": "CVE-2020-25017-39205cc1",
        "signature_version": "v1",
        "digest": {
            "function_hash": "28779119861937653086437382208329983326",
            "length": 383.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc",
            "function": "ContextImpl::dnsNameMatch"
        },
        "id": "CVE-2020-25017-393add04",
        "signature_version": "v1",
        "digest": {
            "function_hash": "28779119861937653086437382208329983326",
            "length": 383.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc"
        },
        "id": "CVE-2020-25017-be1a2ad7",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "312482283805291095438923251672072131439",
                "220996073553402672095052871159566003960",
                "40086084292754689512564420965752459566",
                "94823427644843023793365845609281227913",
                "141395624926811225767987841494254951177",
                "176512010242898287731274919855203773803",
                "227516053637018354786110661305768681255",
                "174062542631163710893467166719856178633"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc"
        },
        "id": "CVE-2020-25017-bf9f394d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "312482283805291095438923251672072131439",
                "220996073553402672095052871159566003960",
                "40086084292754689512564420965752459566",
                "94823427644843023793365845609281227913",
                "141395624926811225767987841494254951177",
                "176512010242898287731274919855203773803",
                "227516053637018354786110661305768681255",
                "174062542631163710893467166719856178633"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "target": {
            "file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
        },
        "id": "CVE-2020-25017-c0db564d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "233543062476617455522480951633830020250",
                "97108442375790762321947506946146541766",
                "236078779863198350661865444030006578300",
                "217084393302201368235197092372183325808",
                "253512937360547730484625776052545965569",
                "315161121815167039058386564384424613564",
                "64277962717543938870529550573365524761",
                "72875440554671668837253923501258011547",
                "81300124250093106394977748984017597331",
                "101683283838141849943852093785343137139",
                "131119519122332572623478841771969132778",
                "308919626256172706172868507353292004170",
                "123542765986267060558112767084589470053",
                "10614619178787704648544071763761786587"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "target": {
            "file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
        },
        "id": "CVE-2020-25017-c14f4174",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "233543062476617455522480951633830020250",
                "97108442375790762321947506946146541766",
                "236078779863198350661865444030006578300",
                "217084393302201368235197092372183325808",
                "253512937360547730484625776052545965569",
                "315161121815167039058386564384424613564",
                "64277962717543938870529550573365524761",
                "72875440554671668837253923501258011547",
                "81300124250093106394977748984017597331",
                "101683283838141849943852093785343137139",
                "131119519122332572623478841771969132778",
                "308919626256172706172868507353292004170",
                "123542765986267060558112767084589470053",
                "10614619178787704648544071763761786587"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "target": {
            "file": "source/common/runtime/runtime_features.cc"
        },
        "id": "CVE-2020-25017-ed2df316",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "125811849769319573303093856788139619288",
                "224857307662273072018732854724032506811",
                "292180642878870327006629255906516181527",
                "301766763199064114172539348285366539316"
            ]
        },
        "deprecated": false
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-25017.json"