ByteOS Network

NVD Vulnerability Details :

CVE-2023-35943

Analyzed

Source-security-advisories@github.com

Published At-25 Jul, 2023 | 19:15

Updated At-02 Aug, 2023 | 18:47

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the `origin` header in the Envoy configuration.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

CPE Matches

envoyproxy>>envoy>>Versions from 1.23.0(inclusive) to 1.23.12(exclusive)

cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

envoyproxy>>envoy>>Versions from 1.24.0(inclusive) to 1.24.10(exclusive)

cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

envoyproxy>>envoy>>Versions from 1.25.0(inclusive) to 1.25.9(exclusive)

cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

envoyproxy>>envoy>>Versions from 1.26.0(inclusive) to 1.26.4(exclusive)

cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-416	Primary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq	security-advisories@github.com	Exploit Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History