Published: 04/04/2023 Updated: 11/04/2023

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 0

DescriptionA flaw was found in Envoy that may allow malicious users to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the HTTP/1 upstream service.A flaw was found in Envoy that may allow malicious users to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the HTTP/1 upstream service.

Vulnerable Product	Search on Vulmon	Subscribe to Product
envoyproxy envoy

Synopsis Important: Red Hat OpenShift Service Mesh 229 security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Service Mesh 229Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, ...

Envoy is an open source edge and service proxy designed for cloud-native applications Prior to versions 1260, 1253, 1244, 1236, and 1229, the client may bypass JSON Web Token (JWT) checks and forge fake original paths The header `x-envoy-original-path` should be an internal header, but Envoy does not remove this header from the request ...

DescriptionA flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the HTTP/1 upstream serviceA flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the HTTP/1 upstream service ...

CWE-444 https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1 https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2 https://datatracker.ietf.org/doc/html/rfc9113#section-8.3 https://access.redhat.com/errata/RHSA-2023:4623 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALASECS-2023-003.html https://access.redhat.com/security/cve/cve-2023-27491

CVE-2023-27491

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect