Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.25.0, < 1.25.3, >= 1.24.0, < 1.24.4, >= 1.23.0, < 1.23.6, < 1.22.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ecs-service-connect-agent | v1.25.4.0-1.amzn2023 | ALAS2023-2023-165 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | istio +1 | 1.15.7-1.el8 | ELSA-2023-12356, ELSA-2023-12354 |
| Oracle Linux 8 | kubeadm +2 | 1.24.8-2.el8 | ELSA-2023-12356, ELSA-2023-12354 |
| Oracle Linux 8 | olcne-rook-chart +4 | 1.6.1-9.el8 | ELSA-2023-23648, ELSA-2023-12354 |
| Oracle Linux 8 | olcnectl +11 | 1.5.12-6.el8 | ELSA-2023-12356, ELSA-2023-12354 |
| Oracle Linux 7 | istio +1 | 1.15.7-1.el7 | ELSA-2023-12357, ELSA-2023-12355 |
| Oracle Linux 7 | kubeadm +2 | 1.24.8-2.el7 | ELSA-2023-12357, ELSA-2023-12355 |
| Oracle Linux 7 | olcne-rook-chart +4 | 1.6.1-9.el7 | ELSA-2023-23649, ELSA-2023-12355 |
| Oracle Linux 7 | olcnectl +11 | 1.5.12-6.el7 | ELSA-2023-12357, ELSA-2023-12355 |
Advisories 8
- WID-SEC-2023-2058 Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2023
- ELSA-2023-23649 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 2, 2023
- ELSA-2023-12356 Important: istio security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 2, 2023
- ELSA-2023-23648 Important: olcne security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 2, 2023
- ELSA-2023-12354 Important: istio security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 2, 2023
- ELSA-2023-12357 Important: istio security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 2, 2023
- ELSA-2023-12355 Important: istio security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 2, 2023
- ALAS2023-2023-165 Important: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 3, 2023