CVE-2023-27493: Envoy doesn't escape HTTP header values
A specifically constructed HTTP request or mTLS connection with a specifically crafted client certificate.
Envoy configuration must also include an option to add request headers that were generated using inputs from the request, i.e. the peer certificate SAN.
Other sources
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-27493?
CVE-2023-27493 is a vulnerability in Envoy, an open source edge and service proxy, that allows illegal characters in header values, leading to potential security risks.
How severe is CVE-2023-27493?
CVE-2023-27493 has a severity score of 9.1, which is considered critical.
Which versions of Envoy are affected by CVE-2023-27493?
Versions 1.22.9, 1.23.0 to 1.23.6, 1.24.0 to 1.24.4, and 1.25.0 to 1.25.3 of Envoy are affected by CVE-2023-27493.
How can I fix CVE-2023-27493?
To fix CVE-2023-27493, you should upgrade to Envoy versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9, which have addressed the vulnerability.
Where can I find more information about CVE-2023-27493?
You can find more information about CVE-2023-27493 in the official security advisories from Envoy and Red Hat, as well as on the CVE page provided.