CVE-2020-35470: High severity envoy proxy vulnerability
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
Other sources
Envoy Proxy could provide weaker than expected security, caused by the logging of the incorrect downstream address. An attacker could exploit this vulnerability to launch further attacks on the system.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-35470?
CVE-2020-35470 is a vulnerability in Envoy Proxy that could result in weaker than expected security due to the logging of the incorrect downstream address.
Which software versions are affected by CVE-2020-35470?
Envoy versions up to 1.16.1 and IBM Cloud Pak for Security (CP4S) versions up to 1.6.0.1 are affected by CVE-2020-35470.
What is the severity of CVE-2020-35470?
CVE-2020-35470 has a severity rating of 8.8 (high).
How does CVE-2020-35470 impact Envoy Proxy?
CVE-2020-35470 impacts Envoy Proxy by logging an incorrect downstream address when using tcp-proxy as the network filter.
How can I mitigate the risk of CVE-2020-35470?
To mitigate the risk of CVE-2020-35470, update Envoy Proxy to version 1.16.1 or later.