CVE-2023-27493
envoy: envoy doesn't escape HTTP header values
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (high), Amazon (high), Oracle (high).
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
| amazon linux 2023 | ecs-service-connect-agent | v1.25.4.0-1.amzn2023 |
| Oracle Linux 7 | istio, istio-istioctl, kubeadm and 19 more | 1.16.4-1.el7 and 2 more |
| Oracle Linux 8 | istio, istio-istioctl, kubeadm and 19 more | 1.16.4-1.el8 and 2 more |
| Red Hat | servicemesh-proxy, servicemesh-proxy-wasm | no fix listed |
Show all 48 entries from 5 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
| amazon linux 2023 | ecs-service-connect-agent | v1.25.4.0-1.amzn2023 |
| Oracle Linux 7 | istio | 1.16.4-1.el7 |
| Oracle Linux 7 | istio-istioctl | 1.16.4-1.el7 |
| Oracle Linux 7 | kubeadm | 1.25.7-2.el7 |
| Oracle Linux 7 | kubectl | 1.25.7-2.el7 |
| Oracle Linux 7 | kubelet | 1.25.7-2.el7 |
| Oracle Linux 7 | olcne-agent | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-api-server | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-calico-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-extra-modules | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-gluster-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-grafana-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-istio-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-kubevirt-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-metallb-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-multus-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-nginx | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-oci-ccm-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-olm-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-prometheus-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-rook-chart | 1.6.1-9.el7 |
| Oracle Linux 7 | olcne-utils | 1.6.1-9.el7 |
| Oracle Linux 7 | olcnectl | 1.6.1-9.el7 |
| Oracle Linux 8 | istio | 1.16.4-1.el8 |
| Oracle Linux 8 | istio-istioctl | 1.16.4-1.el8 |
| Oracle Linux 8 | kubeadm | 1.25.7-2.el8 |
| Oracle Linux 8 | kubectl | 1.25.7-2.el8 |
| Oracle Linux 8 | kubelet | 1.25.7-2.el8 |
| Oracle Linux 8 | olcne-agent | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-api-server | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-calico-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-extra-modules | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-gluster-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-grafana-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-istio-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-kubevirt-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-metallb-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-multus-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-nginx | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-oci-ccm-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-olm-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-prometheus-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-rook-chart | 1.6.1-9.el8 |
| Oracle Linux 8 | olcne-utils | 1.6.1-9.el8 |
| Oracle Linux 8 | olcnectl | 1.6.1-9.el8 |
| Red Hat | servicemesh-proxy | no fix listed |
| Red Hat | servicemesh-proxy-wasm | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2023-27493
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5w5-487h-qv8q
- https://linux.oracle.com/cve/CVE-2023-27493.html
- https://linux.oracle.com/errata/ELSA-2023-23649.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-27493
- https://www.cve.org/CVERecord?id=CVE-2023-27493