by Kastro
Paper/Archive/CVE-2023-27491

CVE-2023-27491

envoyproxy envoy — Envoy forwards invalid Http2/Http3 downstream headers

EPSS 0.9%public exploitCVSS 9.1
critical.is priorityof 100
49
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.8.588 × 2011.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.

Affected

ProductAffectedFixed inSource
envoy>= 1.25.0, < 1.25.3–CNA
envoy>= 1.24.0, < 1.24.4–CNA
envoy>= 1.23.0, < 1.23.6–CNA
envoy< 1.22.9–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rprefdatatracker.ietf.org/doc/html/rfc9113#section-8.3refdatatracker.ietf.org/doc/html/rfc9114#section-4.3.1refrfc-editor.org/rfc/rfc9110#section-5.6.2