CVE-2021-32777

{"id": "CVE-2021-32777", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2021-08-24T21:15:06.970", "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.envoyproxy.io/docs/envoy/v1.19.0/version_history/version_history", "tags": ["Release Notes", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-551"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value headers according to the HTTP spec. However, only the last header value is sent. This may allow specifically crafted requests to bypass authorization. Attackers may be able to escalate privileges when using ext-authz extension or back end service that uses multiple value headers for authorization. A specifically constructed request may be delivered by an untrusted downstream peer in the presence of ext-authz extension. Envoy versions 1.19.1, 1.18.4, 1.17.4, 1.16.5 contain fixes to the ext-authz extension to correctly merge multiple request header values, when sending request for authorization."}, {"lang": "es", "value": "Envoy es un proxy L7 de c\u00f3digo abierto y un bus de comunicaci\u00f3n dise\u00f1ado para grandes arquitecturas modernas orientadas a servicios. En las versiones afectadas, cuando la extensi\u00f3n ext-authz env\u00eda los encabezados de las peticiones al servicio de autorizaci\u00f3n externo, debe combinar varios encabezados de valores de acuerdo con las especificaciones HTTP. Sin embargo, s\u00f3lo se env\u00eda el \u00faltimo valor del encabezado. Esto puede permitir a peticiones espec\u00edficamente dise\u00f1adas omitir la autorizaci\u00f3n. Unos atacantes pueden ser capaces de escalar privilegios cuando es usada la extensi\u00f3n ext-authz o el servicio de back-end que usa m\u00faltiples valores del encabezado para la autorizaci\u00f3n. Una petici\u00f3n espec\u00edficamente construida puede ser entregada por un peer downstream no confiable en presencia de la extensi\u00f3n ext-authz. Envoy versiones 1.19.1, 1.18.4, 1.17.4, 1.16.5, contienen correcciones a la extensi\u00f3n ext-authz para combinar correctamente los valores de los encabezados de peticiones m\u00faltiples, cuando se env\u00edan peticiones de autorizaci\u00f3n."}], "lastModified": "2022-06-15T15:50:23.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFC3BF7F-5B28-4765-8C6F-E2437A4B425D", "versionEndExcluding": "1.16.5", "versionStartIncluding": "1.16.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83547329-1394-417F-93DB-70C1A9D173B0", "versionEndExcluding": "1.17.4", "versionStartIncluding": "1.17.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7376E28-9915-4CA1-A5DB-40874D10E781", "versionEndExcluding": "1.18.4", "versionStartIncluding": "1.18.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:1.19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1968AA35-60E2-4A00-84A0-617738B55D33"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}