关键信息总结 漏洞编号: CVE-2019-18802 severity: High 影响力: A request header with trailing whitespace may cause route matchers or access controls to be bypassed, resulting in escalation of privileges or information disclosure. CVSS 评分: 7.5 受影响版本: Envoy 1.12.1 and before. 受影响组件: HTTP/1.x codec 攻击向量: An untrusted remote client may send HTTP headers with whitespace after the header content to bypass matchers. 发现者: Alyssa Wilk, Google 细节: The parser in Envoy's HTTP/1 codec incorrectly fails to trim whitespace after header values. This can result in significant security issues in multi-level deployments where content might be inappropriately exposed. 缓解方案: Disable upstream HTTP/1. 检测: Look for untrimmed hosts in access logs. 参考资料: CVE-2019-18802