Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes
CVE-2023-35944
What is CVE-2023-35944?
Envoy is a widely used open-source edge and service proxy that facilitates cloud-native applications. The vulnerability arises from Envoy's handling of mixed-case schemes in HTTP/2. While Envoy permits mixed-case schemes, the internal checks for these schemes are case-sensitive in the affected versions. This discrepancy can result in erroneous rejection of requests with mixed-case schemes such as 'htTp' or 'htTps', and it may also allow the bypass of requests with 'https' in unencrypted contexts. The patched versions (1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12) provide a solution by lowering all scheme values by default and updating the internal checks to be case-insensitive. No workarounds are available for this vulnerability.
Affected Version(s)
envoy >= 1.26.0, < 1.26.4 < 1.26.0, 1.26.4
envoy >= 1.25.0, < 1.25.9 < 1.25.0, 1.25.9
envoy >= 1.24.0, < 1.24.10 < 1.24.0, 1.24.10