kritik
CVE-2023-35941
envoy: OAuth2 credentials exploit with permanent validity
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Bitnami. Daha düşük diyenler: Red Hat (yüksek), Amazon (yüksek), Oracle (yüksek).
Açıklama
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.23.12, 1.24.10, 1.25.9, 1.26.4 |
| amazon linux 2023 | ecs-service-connect-agent | v1.26.4.0-1.amzn2023 |
| Oracle Linux 7 | istio, istio-istioctl, olcne-agent ve 13 tane daha | 1.16.7-1.el7 ve 1 tane daha |
| Oracle Linux 8 | istio, istio-istioctl, olcne-agent ve 16 tane daha | 1.17.5-1.el8 ve 2 tane daha |
| Oracle Linux 9 | istio, istio-istioctl, olcne-agent ve 16 tane daha | 1.17.5-1.el9 ve 2 tane daha |
5 kaynaktaki 56 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.23.12, 1.24.10, 1.25.9, 1.26.4 |
| amazon linux 2023 | ecs-service-connect-agent | v1.26.4.0-1.amzn2023 |
| Oracle Linux 7 | istio | 1.16.7-1.el7 |
| Oracle Linux 7 | istio-istioctl | 1.16.7-1.el7 |
| Oracle Linux 7 | olcne-agent | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-api-server | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-calico-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-gluster-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-grafana-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-istio-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-metallb-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-multus-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-nginx | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-oci-ccm-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-olm-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-prometheus-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-utils | 1.6.3-1.el7 |
| Oracle Linux 7 | olcnectl | 1.6.3-1.el7 |
| Oracle Linux 8 | istio | 1.17.5-1.el8 |
| Oracle Linux 8 | istio-istioctl | 1.17.5-1.el8 |
| Oracle Linux 8 | olcne-agent | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-api-server | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-calico-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-gluster-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-grafana-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-istio-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-kubevirt-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-metallb-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-multus-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-nginx | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-oci-ccm-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-olm-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-prometheus-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-rook-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-utils | 1.7.2-3.el8 |
| Oracle Linux 8 | olcnectl | 1.7.2-3.el8 |
| Oracle Linux 8 | virtctl | 0.58.0-3.el8 |
| Oracle Linux 9 | istio | 1.17.5-1.el9 |
| Oracle Linux 9 | istio-istioctl | 1.17.5-1.el9 |
| Oracle Linux 9 | olcne-agent | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-api-server | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-calico-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-gluster-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-grafana-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-istio-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-kubevirt-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-metallb-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-multus-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-nginx | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-oci-ccm-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-olm-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-prometheus-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-rook-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-utils | 1.7.2-2.el9 |
| Oracle Linux 9 | olcnectl | 1.7.2-2.el9 |
| Oracle Linux 9 | virtctl | 0.58.0-3.el9 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2023-35941
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55
- https://linux.oracle.com/cve/CVE-2023-35941.html
- https://linux.oracle.com/errata/ELSA-2023-12781.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-35941
- https://www.cve.org/CVERecord?id=CVE-2023-35941