Bug 2217977 (CVE-2023-35941) - CVE-2023-35941 envoy: OAuth2 credentials exploit with permanent validity
Summary: CVE-2023-35941 envoy: OAuth2 credentials exploit with permanent validity
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2023-35941
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2217969
TreeView+ depends on / blocked
 
Reported: 2023-06-27 18:24 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-14 17:35 UTC (History)
4 users (show)

Fixed In Version: envoy 1.26.3, envoy 1.25.8, envoy 1.24.9, envoy 1.23.11
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Envoy, where a malicious client can construct credentials with permanent validity in a specific scenario. This issue is caused by some rare scenarios, such as the combination of host and expiration time, in which the HMAC payload can always be valid in the OAuth2 filter's HMAC check.
Clone Of:
Environment:
Last Closed: 2023-08-11 21:32:47 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4624 0 None None None 2023-08-11 16:48:16 UTC
Red Hat Product Errata RHSA-2023:4625 0 None None None 2023-08-11 16:49:02 UTC
Red Hat Product Errata RHSA-2023:5175 0 None None None 2023-09-14 17:35:41 UTC

Description Guilherme de Almeida Suckevicz 2023-06-27 18:24:24 UTC 
Malicious client is able to construct credentials with permanent validity in some specific scenario. This is caused by some rare scenarios, like the combination of host and expire time, in which HMAC payload can be always valid in OAuth2 filter's HMAC check.
Comment 4 errata-xmlrpc 2023-08-11 16:48:16 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.3 for RHEL 8

Via RHSA-2023:4624 https://access.redhat.com/errata/RHSA-2023:4624
Comment 5 errata-xmlrpc 2023-08-11 16:49:01 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.4 for RHEL 8

Via RHSA-2023:4625 https://access.redhat.com/errata/RHSA-2023:4625
Comment 6 Product Security DevOps Team 2023-08-11 21:32:46 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-35941
Comment 7 errata-xmlrpc 2023-09-14 17:35:40 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Service Mesh 2.2 for RHEL 8

Via RHSA-2023:5175 https://access.redhat.com/errata/RHSA-2023:5175
Note You need to log in before you can comment on or make changes to this bug.