QID 355870

envoy is an open source edge and service proxy designed for cloud-native applications.
Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios.
This is caused by the some rare scenarios in which hmac payload can be always valid in oauth2 filters check.
Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue.
As a workaround, avoid wildcards/prefix domain wildcards in the hosts domain configuration. (
( CVE-2023-35941) envoy is an open source edge and service proxy designed for cloud-native applications.
Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, grpc access loggers using listeners global scope can cause a `use-after-free` crash when the listener is drained.
As a workaround, disable grpc access log or stop listener update. (
( CVE-2023-35942) envoy is an open source edge and service proxy designed for cloud-native applications.
Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the cors filter will segfault and crash envoy when the `origin` header is removed and deleted between `decodeheaders`and `encodeheaders`.
As a workaround, do not remove the `origin` header in the envoy configuration. (
( CVE-2023-35943) envoy is an open source edge and service proxy designed for cloud-native applications.
Envoy allows mixed-case schemes in http/2, however, some internal scheme checks are case-sensitive.
With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.