critical
CVE-2023-35941
envoy: OAuth2 credentials exploit with permanent validity
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Bitnami. Rated lower by Red Hat (high), Amazon (high), Oracle (high).
Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.23.12, 1.24.10, 1.25.9, 1.26.4 |
| amazon linux 2023 | ecs-service-connect-agent | v1.26.4.0-1.amzn2023 |
| Oracle Linux 7 | istio, istio-istioctl, olcne-agent and 13 more | 1.16.7-1.el7 and 1 more |
| Oracle Linux 8 | istio, istio-istioctl, olcne-agent and 16 more | 1.17.5-1.el8 and 2 more |
| Oracle Linux 9 | istio, istio-istioctl, olcne-agent and 16 more | 1.17.5-1.el9 and 2 more |
Show all 56 entries from 5 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | envoy | 1.23.12, 1.24.10, 1.25.9, 1.26.4 |
| amazon linux 2023 | ecs-service-connect-agent | v1.26.4.0-1.amzn2023 |
| Oracle Linux 7 | istio | 1.16.7-1.el7 |
| Oracle Linux 7 | istio-istioctl | 1.16.7-1.el7 |
| Oracle Linux 7 | olcne-agent | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-api-server | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-calico-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-gluster-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-grafana-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-istio-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-metallb-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-multus-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-nginx | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-oci-ccm-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-olm-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-prometheus-chart | 1.6.3-1.el7 |
| Oracle Linux 7 | olcne-utils | 1.6.3-1.el7 |
| Oracle Linux 7 | olcnectl | 1.6.3-1.el7 |
| Oracle Linux 8 | istio | 1.17.5-1.el8 |
| Oracle Linux 8 | istio-istioctl | 1.17.5-1.el8 |
| Oracle Linux 8 | olcne-agent | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-api-server | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-calico-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-gluster-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-grafana-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-istio-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-kubevirt-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-metallb-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-multus-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-nginx | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-oci-ccm-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-olm-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-prometheus-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-rook-chart | 1.7.2-3.el8 |
| Oracle Linux 8 | olcne-utils | 1.7.2-3.el8 |
| Oracle Linux 8 | olcnectl | 1.7.2-3.el8 |
| Oracle Linux 8 | virtctl | 0.58.0-3.el8 |
| Oracle Linux 9 | istio | 1.17.5-1.el9 |
| Oracle Linux 9 | istio-istioctl | 1.17.5-1.el9 |
| Oracle Linux 9 | olcne-agent | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-api-server | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-calico-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-gluster-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-grafana-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-istio-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-kubevirt-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-metallb-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-multus-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-nginx | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-oci-ccm-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-olm-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-prometheus-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-rook-chart | 1.7.2-2.el9 |
| Oracle Linux 9 | olcne-utils | 1.7.2-2.el9 |
| Oracle Linux 9 | olcnectl | 1.7.2-2.el9 |
| Oracle Linux 9 | virtctl | 0.58.0-3.el9 |
References
- https://access.redhat.com/security/cve/CVE-2023-35941
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55
- https://linux.oracle.com/cve/CVE-2023-35941.html
- https://linux.oracle.com/errata/ELSA-2023-12781.html
- https://nvd.nist.gov/vuln/detail/CVE-2023-35941
- https://www.cve.org/CVERecord?id=CVE-2023-35941