Skip to content
OpenAdvisories
Medium RHSA-2019:0741 2 CVEs

Red Hat Security Advisory: Istio-Proxy Security Update

Published Sep 16, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Service Mesh 0 service_mesh:0 servicemesh-proxy 0:0.9.1-1.el7

Vulnerabilities 2

  • Medium 6.5
    CVE-2019-9900

    When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). …

  • Medium 6.5
    CVE-2019-9901

    EnvoyProxy Envoy Missing HTTP URL path normalization

    Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., something/../admin, to bypass access control, e.g., a block on /admin. A backend server could then interpret the non-normalized path and provide an at…

    github.com/envoyproxy/envoy Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1698020
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1698025
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0741.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-9900
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9900
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9900
  • report
    https://access.redhat.com/security/cve/CVE-2019-9901
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9901
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9901