HTTP Request Smuggling Affecting istio-istioctl package, versions <0:1.16.7-1.el7


Severity

Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.05% (24th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE7-ISTIOISTIOCTL-5890676
  • published7 Sept 2023
  • disclosed25 Jul 2023

Introduced: 25 Jul 2023

CVE-2023-35944  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade Oracle:7 istio-istioctl to version 0:1.16.7-1.el7 or higher.
This issue was patched in ELSA-2023-12781.

NVD Description

Note: Versions mentioned in the description apply only to the upstream istio-istioctl package and not the istio-istioctl package as distributed by Oracle. See How to fix? for Oracle:7 relevant fixed versions and status.

Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as htTp or htTps, or the bypassing of some requests such as https in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.

CVSS Scores

version 3.1