Back to bug 2179135

Who When What Removed Added
Anten Skrabec 2023-03-16 17:26:27 UTC CC security-response-team
Paige Jung 2023-03-16 17:51:16 UTC Doc Text The header x-envoy-original-path should be an internal header, but Envoy
does not remove this header from the request at the beginning of request
processing when it is sent from an untrusted client.

The faked header would then be used for trace logs and grpc logs, as
well as used in the URL used for jwt_authn checks if the jwt_authn
filter is used, and any other upstream use of the x-envoy-original-path
header.
A flaw was found in envoy. The header x-envoy-original-path should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header could then be used for trace logs and grpc logs, used in the URL for jwt_authn checks if the jwt_authn filter is used, and any other upstream use of the x-envoy-original-path header.
Sam Fowler 2023-03-19 22:51:42 UTC CC ovanders sfowler, twalsh
Doc Type --- If docs needed, set a value
Pedro Sampaio 2023-04-04 19:14:20 UTC Group security, qe_staff
Summary EMBARGOED CVE-2023-27487 envoy: Client may fake the header `x-envoy-original-path` CVE-2023-27487 envoy: Client may fake the header `x-envoy-original-path`
Deadline 2023-04-04
Red Hat Bugzilla 2023-07-07 08:35:13 UTC Assignee security-response-team nobody
CC security-response-team
errata-xmlrpc 2023-08-11 16:48:13 UTC Link ID Red Hat Product Errata RHSA-2023:4623
Product Security DevOps Team 2023-08-11 21:10:33 UTC Resolution --- ERRATA
Status NEW CLOSED
Last Closed 2023-08-11 21:10:33 UTC

Back to bug 2179135