CVE-2023-27491 Envoy forwards invalid Http2/Http3 downstream headers
Attackers can bypass security policies by sending malformed HTTP/1 requests that Envoy forwards to non-compliant downstream services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-27491?
CVE-2023-27491 is a medium-severity vulnerability in Envoyproxy Envoy, published on 4 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
Which versions are affected by CVE-2023-27491?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.22.9, 1.23.6, 1.24.4, 1.25.3 |
Products include Envoyproxy Envoy.
How do I fix CVE-2023-27491?
Upgrade envoy to a fixed version for your release line: 1.22.9, 1.23.6, 1.24.4 or 1.25.3.
Is CVE-2023-27491 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27491 exists.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2023-27491, GHSA-5jmv-cw9p-f9rp.