Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes
CVE-2023-35944
What is CVE-2023-35944?
Envoy is a widely used open-source edge and service proxy that facilitates cloud-native applications. The vulnerability arises from Envoy's handling of mixed-case schemes in HTTP/2. While Envoy permits mixed-case schemes, the internal checks for these schemes are case-sensitive in the affected versions. This discrepancy can result in erroneous rejection of requests with mixed-case schemes such as 'htTp' or 'htTps', and it may also allow the bypass of requests with 'https' in unencrypted contexts. The patched versions (1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12) provide a solution by lowering all scheme values by default and updating the internal checks to be case-insensitive. No workarounds are available for this vulnerability.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
envoy >= 1.26.0, < 1.26.4 < 1.26.0, 1.26.4
envoy >= 1.25.0, < 1.25.9 < 1.25.0, 1.25.9
envoy >= 1.24.0, < 1.24.10 < 1.24.0, 1.24.10
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved