Bug 2339147 (CVE-2025-0754) - CVE-2025-0754 envoyproxy: OpenShift Service Mesh 2.6.3 and 2.5.6 Envoy Header Handling Allows Log Injection and Potential Spoofing [NEEDINFO]
Summary: CVE-2025-0754 envoyproxy: OpenShift Service Mesh 2.6.3 and 2.5.6 Envoy Header...
Keywords:
Status: NEW
Alias: CVE-2025-0754
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-01-21 14:28 UTC by OSIDB Bzimport
Modified: 2025-05-27 08:25 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
sburke: needinfo? (dcillera)


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-01-21 14:28:39 UTC
The vulnerability arises due to insufficient sanitization of HTTP headers within the OpenShift Service Mesh, specifically allowing log injection attacks via the x-forwarded-for header. This could result in misleading log entries, potential XSS attacks, and misattribution of request sources. However, the impact is limited since it primarily affects logging and does not directly lead to remote code execution or privilege escalation.

Comment 4 dcillera 2025-03-19 17:11:54 UTC
The advised remediation is the same described in my comment (with the date March 19th) in Bug 2339115  based on Envoy configuration and summarized in the following:

1)Filter possibly malicious headers
Any HTTP header (x-forwarded-for included) can be stripped from a request by using the key "request_headers_to_remove".

2)Do not trust addresses in the x-forwarded-for header but use Downstream IP address.
This is possible with the following configuration:
 
xff_num_trusted_hops = 0 (no trusted addresses in XFF)
use_remote_address=true (untrusted environments: do not use the x-forwarded-for HTTP header but use downstream real address instead)


Note You need to log in before you can comment on or make changes to this bug.