vulnerability

Oracle Linux: (CVE-2023-35944) (Multiple Advisories): olcne security update

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Jul 25, 2023
Added
Sep 6, 2023
Modified
Jan 28, 2025

Description

Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can lead to the rejection of requests with mixed-case schemes such as `htTp` or `htTps`, or the bypassing of some requests such as `https` in unencrypted connections. With a fix in versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, Envoy will now lowercase scheme values by default, and change the internal scheme checks that were case-sensitive to be case-insensitive. There are no known workarounds for this issue.

Solution(s)

oracle-linux-upgrade-istiooracle-linux-upgrade-istio-istioctloracle-linux-upgrade-kubevirtoracle-linux-upgrade-olcneoracle-linux-upgrade-olcne-agentoracle-linux-upgrade-olcne-api-serveroracle-linux-upgrade-olcne-calico-chartoracle-linux-upgrade-olcne-gluster-chartoracle-linux-upgrade-olcne-grafana-chartoracle-linux-upgrade-olcne-istio-chartoracle-linux-upgrade-olcne-kubevirt-chartoracle-linux-upgrade-olcne-metallb-chartoracle-linux-upgrade-olcne-multus-chartoracle-linux-upgrade-olcne-nginxoracle-linux-upgrade-olcne-oci-ccm-chartoracle-linux-upgrade-olcne-olm-chartoracle-linux-upgrade-olcne-prometheus-chartoracle-linux-upgrade-olcne-rook-chartoracle-linux-upgrade-olcne-utilsoracle-linux-upgrade-olcnectloracle-linux-upgrade-virtctl
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.