CVE-2020-25017: 
NixOS vulnerability analysis and mitigation

CVE-2020-25017 affects Envoy through version 1.15.0, where the system only considers the first value when multiple header values are present for some HTTP headers. This vulnerability was discovered in 2020 and specifically relates to how Envoy's setCopy() header map API fails to replace all existing occurrences of a non-inline header (GitHub Advisory).

The vulnerability stems from Envoy's HeaderMapImpl implementation, which handles two classes of headers: inline and non-inline. While inline headers treat multiple values as comma-delimited strings per RFC7230, non-inline headers have ordered multi-map semantics. Components using the get() method only observe the first header value. The CVSS v3.1 base score is 8.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L (NVD, GitHub Advisory).

The vulnerability affects multiple components including request routing via header matching, access log filtering, RBAC, CEL matching, ext_authz filter, header to metadata filter, JWT filter, and Lua filter. This can lead to inconsistencies between Envoy's request matching and the upstream view of the request. For example, if Envoy validates credentials and scope headers, it might only validate the first scope header while the upstream may interpret all provided scopes as valid (GitHub Advisory).

An attacker can exploit this vulnerability by including multiple values of 'reference' headers (headers not explicitly listed as 'inline'). For example, by setting multiple values like 'x-foo: bar' and 'x-foo: baz', where Envoy would only observe the first value in matchers, but both values would be forwarded to upstreams (GitHub Advisory).

The vulnerability has been patched in versions 1.15.1, 1.14.5, 1.13.5, and 1.12.7. The fix ensures that setCopy() now consistently replaces all occurrences of a header with a single value (GitHub Advisory, Red Hat).

The vulnerability received attention from major organizations, with Red Hat issuing a security advisory classifying it as having a 'Moderate' security impact. The issue was also discussed in the Kubernetes community as part of their regular security updates (Red Hat).