CVE-2023-35941

Published: Jul 25, 2023Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This is caused by the some rare scenarios in which HMAC payload can be always valid in OAuth2 filter's check. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, avoid wildcards/prefix domain wildcards in the host's domain configuration.

Affected (4)

Products: Envoyproxy: Envoy

Envoyproxy

1 product

Envoy

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Envoyproxy Envoy	From 1.23.0 to 1.23.12
Envoyproxy Envoy	From 1.24.0 to 1.24.10
Envoyproxy Envoy	From 1.25.0 to 1.25.9
Envoyproxy Envoy	From 1.26.0 to 1.26.4

Related CWEs

CWE-116

Improper Encoding or Escaping of Output

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (2)

https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55

Source: security-advisories@github.com

Third Party Advisory

https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.