Description
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the `origin` header in the Envoy configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| envoyproxy | envoy | >= 1.26.0, < 1.26.4, >= 1.25.0, < 1.25.9, >= 1.24.0, < 1.24.10, < 1.23.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ecs-service-connect-agent | v1.26.4.0-1.amzn2023 | ALAS2023-2023-300 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | istio +1 | 1.17.5-1.el9 | ELSA-2023-12771 |
| Oracle Linux 9 | olcnectl +15 | 1.7.2-2.el9 | ELSA-2023-12771 |
| Oracle Linux 9 | virtctl | 0.58.0-3.el9 | ELSA-2023-12771 |
| Oracle Linux 8 | istio +1 | 1.16.7-1.el8 | ELSA-2023-12780, ELSA-2023-12772 |
| Oracle Linux 8 | olcne-rook-chart +1 | 1.7.2-3.el8 | ELSA-2023-12772 |
| Oracle Linux 8 | olcnectl +13 | 1.6.3-1.el8 | ELSA-2023-12780, ELSA-2023-12772 |
| Oracle Linux 8 | virtctl | 0.58.0-3.el8 | ELSA-2023-12772 |
| Oracle Linux 7 | istio +1 | 1.16.7-1.el7 | ELSA-2023-12781 |
| Oracle Linux 7 | olcnectl +13 | 1.6.3-1.el7 | ELSA-2023-12781 |
Advisories 6
- WID-SEC-2023-2058 Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2023
- ELSA-2023-12772 Important: olcne security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 11, 2023
- ELSA-2023-12780 Important: istio security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 8, 2023
- ELSA-2023-12781 Important: istio security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 8, 2023
- ELSA-2023-12771 Important: istio security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 6, 2023
- ALAS2023-2023-300 Important: ecs-service-connect-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 23, 2023