High severity · published Dec 15, 2020
CVE-2020-35470
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header
8.8
CVSS
1%
EPSS
No
On KEV
Description
Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter (not HTTP filters).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Envoy · Envoyproxy
before 1.16.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-35470
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-35470
Patch
https://github.com/envoyproxy/envoy/compare/v1.16.0...v1.16.1
Patch
https://github.com/envoyproxy/envoy/issues/14087
Patch
https://github.com/envoyproxy/envoy/pull/14131
More from Envoy
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2019-9901
Envoy 1.9.0 and before does not normalize HTTP URL paths
9.8
CVE-2023-35941
Envoy is an open source edge and service proxy designed for cloud-native applications
9.8
CVE-2023-27488
Envoy is an open source edge and service proxy designed for cloud-native applications