Harvey Tuch

The issue is related to improper input validation in Apache Traffic Server, which can be exploited by a remote attacker to cause a denial of service.

O problema ocorre porque o Envoy considera apenas o primeiro valor quando há vários valores para alguns cabeçalhos HTTP. Além disso, a API de mapeamento de cabeçalhos setCopy() do Envoy não substitui todas as ocorrências existentes de um cabeçalho não embutido.

An issue allows an untrusted remote client to send HTTP/2 requests that can write to the heap outside of the request buffers when the upstream is HTTP/1. This can lead to corruption of nearby heap contents or bypass Envoy's access control mechanisms, such as path-based routing. An attacker may also modify requests from other users that are proximal in time and space.

The issue is related to errors in parsing HTTP headers and URL paths. This can allow a remote attacker to bypass header matching rules and access control, potentially gaining access to unauthorized resources. The vulnerability can be exploited by crafting header values containing embedded NUL characters or by using relative paths to bypass access control.