Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2023-35944 #1970

Closed
GoVulnBot opened this issue Jul 25, 2023 · 1 comment
Closed
Assignees
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.

Comments

@GoVulnBot
Copy link

CVE-2023-35944 references github.com/envoyproxy/envoy, which may be a Go module.

Description:
Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as htTp or htTps, or the bypassing of some requests such as https in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/envoyproxy/envoy
      vulnerable_at: 1.26.3
      packages:
        - package: envoy
description: |-
    Envoy is an open source edge and service proxy designed for cloud-native
    applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal
    scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9,
    1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case
    schemes such as `htTp` or `htTps`, or the bypassing of some requests such as
    `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4,
    1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default,
    and change the internal scheme checks that were case-sensitive to be
    case-insensitive. There are no known workarounds for this issue.
cves:
    - CVE-2023-35944
references:
    - advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g

@neild neild added the excluded: NOT_GO_CODE This vulnerability does not refer to a Go module. label Jul 31, 2023
@neild neild self-assigned this Jul 31, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

This was referenced Nov 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
excluded: NOT_GO_CODE This vulnerability does not refer to a Go module.
Projects
None yet
Development

No branches or pull requests

3 participants