Envoy doesn't escape HTTP header values
CVE-2023-27493

8.1HIGH

Key Information:

Vendor

Envoyproxy

Status
Envoy
Vendor
CVE Published:
4 April 2023

What is CVE-2023-27493?

Envoy Proxy is a widely-used open-source edge and service proxy that supports cloud-native applications. Prior to certain versions, Envoy fails to properly sanitize request properties when generating headers. This oversight can allow the inclusion of illegal characters within header values, which may result in unintended results such as the upstream service misinterpreting the original request as multiple pipelined requests. Such behavior could undermine Envoy's intended security policies. Users are advised to update to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9 for a fix, and as a precaution, consider disabling the inclusion of request headers derived from downstream properties.

Affected Version(s)

envoy >= 1.25.0, < 1.25.3 < 1.25.0, 1.25.3

envoy >= 1.24.0, < 1.24.4 < 1.24.0, 1.24.4

envoy >= 1.23.0, < 1.23.6 < 1.23.0, 1.23.6

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.