CVE-2023-35943
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability in Envoy that causes the application to crash when the `origin` header is removed between `decodeHeaders` and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 contain a fix for this issue.
Risk Assessment
Removing the `origin` header can lead to Envoy crashing, impacting the availability of cloud services. Organizations may experience downtime in their applications.
Recommendation
It is recommended to upgrade to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, or 1.23.12. Alternatively, do not remove the `origin` header in the Envoy configuration.
Original NVD description (English source)
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decodeHeaders`and `encodeHeaders`. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove the `origin` header in the Envoy configuration.