CVE-2023-35941

Summary

CVE-2023-35941 affects Envoy, an open-source edge and service proxy for cloud-native applications. In certain scenarios, prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, malicious clients can construct permanent credentials due to a flaw in the OAuth2 filter's check. This vulnerability arises when HMAC payloads can be valid in specific rare cases. Versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12 have been patched. As a temporary measure, users are advised to avoid using wildcards/prefix domain configurations in their host domain settings.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.