CVE-2023-35944

Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

History

02 Aug 2023, 16:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3
References (MISC) https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g - (MISC) https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g - Exploit, Third Party Advisory
CWE CWE-20 CWE-444
First Time Envoyproxy envoy
Envoyproxy
CPE cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

25 Jul 2023, 19:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-07-25 19:15

Updated : 2023-12-10 15:14


NVD link : CVE-2023-35944

Mitre link : CVE-2023-35944

CVE.ORG link : CVE-2023-35944


JSON object : View

Products Affected

envoyproxy

  • envoy
CWE
CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CWE-20

Improper Input Validation