REDHAT-BUG-2217987: Medium severity envoy proxy vulnerability
Published Jun 27, 2023
·Updated
If origin header is configured to be removed with requestheaderstoremove: origin, CORS filter will segfault and crash Envoy when the origin header is removed and deleted between decodeHeaders and encodeHeaders.
Affected Software
1 affected component
Envoy Envoy
Event History
Jun 27, 2023
Data Sourced
via Red Hat·06:48 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2217987?
The severity of REDHAT-BUG-2217987 is critical due to the potential for Envoy to crash.
2
How do I fix REDHAT-BUG-2217987?
To fix REDHAT-BUG-2217987, avoid configuring the origin header to be removed in your Envoy configuration.
3
What software is affected by REDHAT-BUG-2217987?
The software affected by REDHAT-BUG-2217987 is Envoy Proxy.
4
What issue does REDHAT-BUG-2217987 cause?
REDHAT-BUG-2217987 causes Envoy to segfault and crash when the origin header is removed during processing.
5
Is there a workaround for REDHAT-BUG-2217987?
A possible workaround for REDHAT-BUG-2217987 is to not remove the origin header in the configuration.