1. Home
  2. Vulnerabilities
  3. CVE-2023-35943

CVE-2023-35943

CVSS v3.1 7.5 (High)
75% Progress
EPSS 0.08 % (33th)
0.08% Progress
Affected Products 1
Advisories 4
Info CVSS EPSS Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the origin header is removed and deleted between decodeHeadersand encodeHeaders. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the origin header in the Envoy configuration.

Weaknesses
CWE-416
Use After Free
CVE Status
PUBLISHED
CNA
GitHub, Inc.
Published Date
2023-07-25 19:15:11
(14 months ago)
Updated Date
2023-08-02 18:47:03
(13 months ago)

Affected Products

Envoyproxy

Configuration #1

    CPE23 From Up To
  Envoyproxy Envoy from 1.23.0 version and prior 1.23.12 version cpe:2.3:a:envoyproxy:envoy >= 1.23.0 < 1.23.12
  Envoyproxy Envoy from 1.24.0 version and prior 1.24.10 version cpe:2.3:a:envoyproxy:envoy >= 1.24.0 < 1.24.10
  Envoyproxy Envoy from 1.25.0 version and prior 1.25.9 version cpe:2.3:a:envoyproxy:envoy >= 1.25.0 < 1.25.9
  Envoyproxy Envoy from 1.26.0 version and prior 1.26.4 version cpe:2.3:a:envoyproxy:envoy >= 1.26.0 < 1.26.4