CVE-2023-35943
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-35943
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-35943.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-35943
- Aliases
- Related
- Published
- 2023-07-25T19:15:11Z
- Modified
- 2025-02-19T03:33:16.853626Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the
originheader is removed and deleted betweendecodeHeadersandencodeHeaders. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have a fix for this issue. As a workaround, do not remove theoriginheader in the Envoy configuration. - References