x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2023-27491

[GoVulnBot]

CVE-2023-27491 references github.com/envoyproxy/envoy, which may be a Go module.

Description:
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-27491
• JSON: https://github.com/CVEProject/cvelist/tree/e23d1517acf05c0763a151c5a53ed073e6428f36/2023/27xxx/CVE-2023-27491.json
• advisory: GHSA-5jmv-cw9p-f9rp
• web: https://datatracker.ietf.org/doc/html/rfc9113#section-8.3
• web: https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1
• web: https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2
• Imported by: https://pkg.go.dev/github.com/envoyproxy/envoy?tab=importedby

Cross references:

• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2021-43824 #330 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2021-43825 #331 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2021-43826 #332 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-21654 #333 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-21655 #334 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-21656 #335 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-21657 #336 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-23606 #337 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-29224 #484 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-29225 #485 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-29226 #486 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-29227 #487 NOT_GO_CODE
• Module github.com/envoyproxy/envoy appears in issue x/vulndb: potential Go vuln in github.com/envoyproxy/envoy: CVE-2022-29228 #488 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/envoyproxy/envoy
    packages:
      - package: envoy
description: |
    Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP/1 service may allow malformed requests, potentially leading to a bypass of security policies. This issue is fixed in versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9.
cves:
  - CVE-2023-27491
references:
  - advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp
  - web: https://datatracker.ietf.org/doc/html/rfc9113#section-8.3
  - web: https://datatracker.ietf.org/doc/html/rfc9114#section-4.3.1
  - web: https://www.rfc-editor.org/rfc/rfc9110#section-5.6.2

[gopherbot]

Change https://go.dev/cl/482615 mentions this issue: data/excluded: batch add GO-2023-1701, GO-2023-1700, GO-2023-1699, GO-2023-1687, GO-2023-1685, GO-2023-1695, GO-2023-1694, GO-2023-1693, GO-2023-1692, GO-2023-1691, GO-2023-1690