CVE-2023-35944
Summary
| CVE | CVE-2023-35944 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-07-25 19:15:00 UTC |
|---|
| Updated | 2023-08-02 16:37:00 UTC |
|---|
| Description | Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Envoyproxy |
Envoy |
All |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy · Advisory · envoyproxy/envoy · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 355870 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2023-2023-300
- 356117 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2023-2023-344
- 356246 Amazon Linux Security Advisory for ecs-service-connect-agent : ALASECS-2023-007
- 356504 Amazon Linux Security Advisory for ecs-service-connect-agent : ALAS2ECS-2023-007
