CVE-2023-27493: Envoy doesn't escape HTTP header values
First published: Mon Mar 27 2023(Updated: )
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to characters that are illegal in header values to be sent to the upstream service. In the worst case, it can cause upstream service to interpret the original request as two pipelined requests, possibly bypassing the intent of Envoy’s security policy. Versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9 contain a patch. As a workaround, disable adding request headers based on the downstream request properties, such as downstream certificate properties.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Envoyproxy Envoy | <1.22.9 | |
| Envoyproxy Envoy | >=1.23.0<1.23.6 | |
| Envoyproxy Envoy | >=1.24.0<1.24.4 | |
| Envoyproxy Envoy | >=1.25.0<1.25.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-27493?
CVE-2023-27493 is a vulnerability in Envoy, an open source edge and service proxy, that allows illegal characters in header values, leading to potential security risks.
How severe is CVE-2023-27493?
CVE-2023-27493 has a severity score of 9.1, which is considered critical.
Which versions of Envoy are affected by CVE-2023-27493?
Versions 1.22.9, 1.23.0 to 1.23.6, 1.24.0 to 1.24.4, and 1.25.0 to 1.25.3 of Envoy are affected by CVE-2023-27493.
How can I fix CVE-2023-27493?
To fix CVE-2023-27493, you should upgrade to Envoy versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, or 1.22.9, which have addressed the vulnerability.
Where can I find more information about CVE-2023-27493?
You can find more information about CVE-2023-27493 in the official security advisories from Envoy and Red Hat, as well as on the CVE page provided.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-27493
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/tags
- agent/event
- vendor/envoyproxy
- canonical/envoyproxy envoy
- version/envoyproxy envoy/1.23.0
- version/envoyproxy envoy/1.24.0
- version/envoyproxy envoy/1.25.0