-
Notifications
You must be signed in to change notification settings - Fork 58
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2024-23326 #2890
Labels
Comments
tatianab
added
NeedsTriage
cve-year-2024
possibly not Go
triaged
excluded: NOT_GO_CODE
This vulnerability does not refer to a Go module.
and removed
NeedsTriage
cve-year-2024
possibly not Go
labels
Jun 7, 2024
Change https://go.dev/cl/592765 mentions this issue: |
This was referenced Sep 20, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
CVE-2024-23326 references github.com/envoyproxy/envoy, which may be a Go module.
Description:
Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.
References:
Cross references:
See doc/triage.md for instructions on how to triage this report.
The text was updated successfully, but these errors were encountered: