Back to bug 2217985

Who When What Removed Added
Guilherme de Almeida Suckevicz 2023-06-27 18:43:42 UTC CC security-response-team
Anten Skrabec 2023-06-27 20:01:46 UTC Doc Text A flaw was found in Envoy that allows for mixed-case schemes in HTTP/2, however, some internal scheme checks in Envoy are case-sensitive, leading to incorrect handling of requests and responses with mixed case schemes. For example, if a request with mixed scheme http is sent to the OAuth2 filter, it will fail the exact-match checks for http, and inform the remote endpoint the scheme is https, thus potentially bypassing OAuth2 checks specific to HTTP requests.
Fixed In Version envoy 1.26.3, envoy 1.25.8, envoy 1.24.9, envoy 1.23.11
Anten Skrabec 2023-06-27 20:07:10 UTC Summary EMBARGOED TRIAGE envoy: Incorrect handling of HTTP requests and responses with mixed case schemes EMBARGOED envoy: Incorrect handling of HTTP requests and responses with mixed case schemes
Chess Hazlett 2023-07-06 21:55:01 UTC Alias CVE-2023-35944
Summary EMBARGOED envoy: Incorrect handling of HTTP requests and responses with mixed case schemes EMBARGOED CVE-2023-35944 envoy: Incorrect handling of HTTP requests and responses with mixed case schemes
Red Hat Bugzilla 2023-07-06 21:55:01 UTC CC security-response-team
Red Hat Bugzilla 2023-07-07 08:29:37 UTC Assignee security-response-team nobody
CC security-response-team
RaTasha Tillery-Smith 2023-07-07 12:34:58 UTC Doc Text A flaw was found in Envoy that allows for mixed-case schemes in HTTP/2, however, some internal scheme checks in Envoy are case-sensitive, leading to incorrect handling of requests and responses with mixed case schemes. For example, if a request with mixed scheme http is sent to the OAuth2 filter, it will fail the exact-match checks for http, and inform the remote endpoint the scheme is https, thus potentially bypassing OAuth2 checks specific to HTTP requests. A flaw was found in Envoy that allows for mixed-case schemes in HTTP/2. However, some internal scheme checks in Envoy are case-sensitive, leading to incorrect handling of requests and responses with mixed case schemes. For example, if a request with a mixed scheme HTTP is sent to the OAuth2 filter, it will fail the exact-match checks for HTTP and inform the remote endpoint the scheme is HTTP, thus potentially bypassing OAuth2 checks specific to HTTP requests.
Anten Skrabec 2023-07-11 22:34:38 UTC Deadline 2023-07-18 2023-07-25
Anten Skrabec 2023-07-26 16:34:31 UTC Group qe_staff, security
Summary EMBARGOED CVE-2023-35944 envoy: Incorrect handling of HTTP requests and responses with mixed case schemes CVE-2023-35944 envoy: Incorrect handling of HTTP requests and responses with mixed case schemes
Deadline 2023-07-25
errata-xmlrpc 2023-08-11 16:48:20 UTC Link ID Red Hat Product Errata RHSA-2023:4624
errata-xmlrpc 2023-08-11 16:49:03 UTC Link ID Red Hat Product Errata RHSA-2023:4625
Product Security DevOps Team 2023-08-11 21:35:45 UTC Status NEW CLOSED
Resolution --- ERRATA
Last Closed 2023-08-11 21:35:45 UTC

Back to bug 2217985