Vulnerability-Lookup

CVE-2023-27491 (GCVE-0-2023-27491)

Vulnerability from cvelistv5 – Published: 2023-04-04 18:18 – Updated: 2025-02-11 16:14

Title

Envoy forwards invalid Http2/Http3 downstream headers

Summary

Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-11 16:14 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://datatracker.ietf.org/doc/html/rfc9113#sec…	x_refsource_MISC
https://datatracker.ietf.org/doc/html/rfc9114#sec…	x_refsource_MISC
https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
envoyproxy	envoy	Affected: >= 1.25.0, < 1.25.3 Affected: >= 1.24.0, < 1.24.4 Affected: >= 1.23.0, < 1.23.6 Affected: < 1.22.9	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T12:16:35.377Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
          },
          {
            "name": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
          },
          {
            "name": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
          },
          {
            "name": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-27491",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T16:14:39.480822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T16:14:43.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.25.0, \u003c 1.25.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.24.0, \u003c 1.24.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.6"
            },
            {
              "status": "affected",
              "version": "\u003c 1.22.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-04T18:18:23.433Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
        },
        {
          "name": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
        },
        {
          "name": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
        },
        {
          "name": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
        }
      ],
      "source": {
        "advisory": "GHSA-5jmv-cw9p-f9rp",
        "discovery": "UNKNOWN"
      },
      "title": "Envoy forwards invalid Http2/Http3 downstream headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-27491",
    "datePublished": "2023-04-04T18:18:23.433Z",
    "dateReserved": "2023-03-01T19:03:56.634Z",
    "dateUpdated": "2025-02-11T16:14:43.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-27491",
      "date": "2026-09-15",
      "epss": "0.00869",
      "percentile": "0.5684"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.22.9\", \"matchCriteriaId\": \"DAD93214-C958-4A69-9291-15D1C22CFD3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.23.0\", \"versionEndExcluding\": \"1.23.6\", \"matchCriteriaId\": \"17BFB303-DA5A-4E83-93F7-3C1EA340E434\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.24.0\", \"versionEndExcluding\": \"1.24.4\", \"matchCriteriaId\": \"92B633B8-FA4A-4630-9302-96F2C8336E36\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.25.0\", \"versionEndExcluding\": \"1.25.3\", \"matchCriteriaId\": \"8AFC6741-6FDF-47F6-A4AF-B5F5233ABB71\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.\"}]",
      "id": "CVE-2023-27491",
      "lastModified": "2024-11-21T07:53:00.813",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\", \"baseScore\": 5.4, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.5}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.2}]}",
      "published": "2023-04-04T19:15:07.150",
      "references": "[{\"url\": \"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}, {\"url\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Vendor Advisory\"]}, {\"url\": \"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Not Applicable\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-444\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-27491\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-04-04T19:15:07.150\",\"lastModified\":\"2026-06-17T05:45:19.493\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"envoyproxy\",\"product\":\"envoy\",\"versions\":[{\"version\":\"\u003e= 1.25.0, \u003c 1.25.3\",\"status\":\"affected\"},{\"version\":\"\u003e= 1.24.0, \u003c 1.24.4\",\"status\":\"affected\"},{\"version\":\"\u003e= 1.23.0, \u003c 1.23.6\",\"status\":\"affected\"},{\"version\":\"\u003c 1.22.9\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T16:14:39.480822Z\",\"id\":\"CVE-2023-27491\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-444\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.22.9\",\"matchCriteriaId\":\"DAD93214-C958-4A69-9291-15D1C22CFD3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.23.0\",\"versionEndExcluding\":\"1.23.6\",\"matchCriteriaId\":\"17BFB303-DA5A-4E83-93F7-3C1EA340E434\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.24.0\",\"versionEndExcluding\":\"1.24.4\",\"matchCriteriaId\":\"92B633B8-FA4A-4630-9302-96F2C8336E36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.25.0\",\"versionEndExcluding\":\"1.25.3\",\"matchCriteriaId\":\"8AFC6741-6FDF-47F6-A4AF-B5F5233ABB71\"}]}]}],\"references\":[{\"url\":\"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T15:20:10+00:00",
      "cve": "CVE-2023-27491",
      "id": "CVE-2023-27491",
      "initial_release_date": "2023-04-04T19:00:00+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "18",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-27491.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\", \"name\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\", \"name\": \"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\", \"name\": \"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\", \"name\": \"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T12:16:35.377Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-27491\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T16:14:39.480822Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T16:14:17.859Z\"}}], \"cna\": {\"title\": \"Envoy forwards invalid Http2/Http3 downstream headers\", \"source\": {\"advisory\": \"GHSA-5jmv-cw9p-f9rp\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"envoyproxy\", \"product\": \"envoy\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.25.0, \u003c 1.25.3\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.24.0, \u003c 1.24.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 1.23.0, \u003c 1.23.6\"}, {\"status\": \"affected\", \"version\": \"\u003c 1.22.9\"}]}], \"references\": [{\"url\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\", \"name\": \"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\", \"name\": \"https://datatracker.ietf.org/doc/html/rfc9113#section-8.3\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\", \"name\": \"https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\", \"name\": \"https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2023-04-04T18:18:23.433Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-27491\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-11T16:14:43.908Z\", \"dateReserved\": \"2023-03-01T19:03:56.634Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2023-04-04T18:18:23.433Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

bit-envoy-2023-27491

Vulnerability from bitnami_vulndb

Published

2024-03-06 10:54

Modified

2026-09-08 08:34

Summary

Envoy forwards invalid Http2/Http3 downstream headers

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "envoy",
        "purl": "pkg:bitnami/envoy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.22.9"
            },
            {
              "introduced": "1.23.0"
            },
            {
              "fixed": "1.23.6"
            },
            {
              "introduced": "1.24.0"
            },
            {
              "fixed": "1.24.4"
            },
            {
              "introduced": "1.25.0"
            },
            {
              "fixed": "1.25.3"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-27491"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
  },
  "details": "Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.",
  "id": "BIT-envoy-2023-27491",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T10:54:12.095Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
    },
    {
      "type": "WEB",
      "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
    },
    {
      "type": "WEB",
      "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27491"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Envoy forwards invalid Http2/Http3 downstream headers"
}

FKIE_CVE-2023-27491

Vulnerability from fkie_nvd - Published: 2023-04-04 19:15 - Updated: 2026-06-17 05:45

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://datatracker.ietf.org/doc/html/rfc9113#section-8.3	Not Applicable
security-advisories@github.com	https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1	Not Applicable
security-advisories@github.com	https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp	Exploit, Vendor Advisory
security-advisories@github.com	https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://datatracker.ietf.org/doc/html/rfc9113#section-8.3	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2	Not Applicable

Impacted products

Vendor	Product	Version
envoyproxy	envoy	*
envoyproxy	envoy	*
envoyproxy	envoy	*
envoyproxy	envoy	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.25.0, \u003c 1.25.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.24.0, \u003c 1.24.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.6"
            },
            {
              "status": "affected",
              "version": "\u003c 1.22.9"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAD93214-C958-4A69-9291-15D1C22CFD3F",
              "versionEndExcluding": "1.22.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "17BFB303-DA5A-4E83-93F7-3C1EA340E434",
              "versionEndExcluding": "1.23.6",
              "versionStartIncluding": "1.23.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "92B633B8-FA4A-4630-9302-96F2C8336E36",
              "versionEndExcluding": "1.24.4",
              "versionStartIncluding": "1.24.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AFC6741-6FDF-47F6-A4AF-B5F5233ABB71",
              "versionEndExcluding": "1.25.3",
              "versionStartIncluding": "1.25.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9."
    }
  ],
  "id": "CVE-2023-27491",
  "lastModified": "2026-06-17T05:45:19.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27491",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-11T16:14:39.480822Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-04-04T19:15:07.150",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GSD-2023-27491

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-27491

Aliases

CVE-2023-27491

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-27491",
    "id": "GSD-2023-27491"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-27491"
      ],
      "details": "Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.",
      "id": "GSD-2023-27491",
      "modified": "2023-12-13T01:20:55.438568Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2023-27491",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "envoy",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.25.0, \u003c 1.25.3"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.24.0, \u003c 1.24.4"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.23.0, \u003c 1.23.6"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.22.9"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "envoyproxy"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-20",
                "lang": "eng",
                "value": "CWE-20: Improper Input Validation"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp",
            "refsource": "MISC",
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
          },
          {
            "name": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3",
            "refsource": "MISC",
            "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
          },
          {
            "name": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1",
            "refsource": "MISC",
            "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
          },
          {
            "name": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2",
            "refsource": "MISC",
            "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-5jmv-cw9p-f9rp",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.25.3",
                "versionStartIncluding": "1.25.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.24.4",
                "versionStartIncluding": "1.24.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.23.6",
                "versionStartIncluding": "1.23.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.22.9",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2023-27491"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-444"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1",
              "refsource": "MISC",
              "tags": [
                "Not Applicable"
              ],
              "url": "https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Vendor Advisory"
              ],
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp"
            },
            {
              "name": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2",
              "refsource": "MISC",
              "tags": [
                "Not Applicable"
              ],
              "url": "https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2"
            },
            {
              "name": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3",
              "refsource": "MISC",
              "tags": [
                "Not Applicable"
              ],
              "url": "https://datatracker.ietf.org/doc/html/rfc9113#section-8.3"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2023-04-11T14:43Z",
      "publishedDate": "2023-04-04T19:15Z"
    }
  }
}

RHSA-2023:4623

Vulnerability from csaf_redhat - Published: 2023-08-11 16:46 - Updated: 2026-03-18 02:24

Summary

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2023-27491.

CVE-2023-27491

A flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the upstream HTTP/1 service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 3 products Known not affected: 18 products

https://access.redhat.com/errata/RHSA-2023:4623

Open the full advisory

RHSA-2023_4623

Vulnerability from csaf_redhat - Published: 2023-08-11 16:46 - Updated: 2024-11-23 00:00

Summary

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2023-27491.

CVE-2023-27491

A flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the upstream HTTP/1 service.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Fixed: 3 products Known not affected: 18 products

https://access.redhat.com/errata/RHSA-2023:4623

Open the full advisory

WID-SEC-W-2023-2058

Vulnerability from csaf_certbund - Published: 2023-08-13 22:00 - Updated: 2023-10-08 22:00

Summary

Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen

Severity

Hoch

Scope

11 vulnerabilities in this advisory, including CVE-2023-27491.

CVE-2023-27491

In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente "Envoy". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-27491 (GCVE-0-2023-27491)

bit-envoy-2023-27491

Vulnerability from bitnami_vulndb

FKIE_CVE-2023-27491

GSD-2023-27491

RHSA-2023:4623

RHSA-2023_4623

WID-SEC-W-2023-2058

Tags

Sightings

Nomenclature

Related by attack behaviour