CVE-2023-27488: Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.
First published: Mon Mar 27 2023(Updated: )
A flaw was found in Envoy which could allow an attacker to bypass authentication checks when ext_authz is used by crafting a malicious http header with a non-UTF8 value.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoyproxy Envoy | <1.22.9 | |
| Envoyproxy Envoy | >=1.23.0<1.23.6 | |
| Envoyproxy Envoy | >=1.24.0<1.24.4 | |
| Envoyproxy Envoy | >=1.25.0<1.25.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph
- https://access.redhat.com/errata/RHSA-2023:4623
- https://access.redhat.com/security/cve/cve-2023-27488
- https://bugzilla.redhat.com/show_bug.cgi?id=2182156
- https://www.cve.org/CVERecord?id=CVE-2023-27488 https://nvd.nist.gov/vuln/detail/CVE-2023-27488 https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph
Frequently Asked Questions
What is CVE-2023-27488?
CVE-2023-27488 is a vulnerability in Envoy that allows an attacker to bypass authentication checks when ext_authz filter is configured with failure_mode_allow set to true.
What is the severity of CVE-2023-27488?
CVE-2023-27488 has a severity rating of 9.8 (critical).
Which versions of Envoy are affected by CVE-2023-27488?
Versions prior to 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 of Envoy are affected by CVE-2023-27488.
How can an attacker exploit CVE-2023-27488?
By configuring the ext_authz filter with failure_mode_allow set to true, an attacker can escalate privileges and bypass authentication checks in Envoy.
Is there a fix available for CVE-2023-27488?
Yes, upgrading Envoy to a version equal to or greater than 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9 will fix CVE-2023-27488.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-27488
- agent/softwarecombine
- agent/first-publish-date
- agent/author
- agent/references
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/description
- agent/event
- vendor/envoyproxy
- canonical/envoyproxy envoy
- version/envoyproxy envoy/1.23.0
- version/envoyproxy envoy/1.24.0
- version/envoyproxy envoy/1.25.0