Disable remote proxy patching except AWS Lambda#17415
Merged
Conversation
github-actions
bot
added
theme/api
zalimeni
force-pushed
the
zalimeni/net-3900-only-apply-remote-upstream-extension-aws-lambda
branch
from
500c0fc to
5564260
Compare
zalimeni
added
theme/security
backport/1.15
zalimeni
force-pushed
the
zalimeni/net-3900-only-apply-remote-upstream-extension-aws-lambda
branch
from
5564260 to
b5d084a
Compare
zalimeni
commented
May 22, 2023
.changelog/17415.txt
Outdated
Comment on lines
1
to
7
Member
Author
There was a problem hiding this comment.
I've also seen xds: used often, but extensions: felt ideal if we're generally using that one.
Member
Author
There was a problem hiding this comment.
cc @picatz and @hashicorp/consul-docs in case you have input on changelog (I'm happy to address after merge as well)
zalimeni
removed
the
pr/no-docs
hashi-derek
approved these changes
May 22, 2023
To avoid unintended tampering with remote downstreams via service config, refactor BasicEnvoyExtender and RuntimeConfig to disallow typical Envoy extensions from being applied to non-local proxies. Continue to allow this behavior for AWS Lambda and the read-only Validate builtin extensions. Addresses CVE-2023-2816.
zalimeni
force-pushed
the
zalimeni/net-3900-only-apply-remote-upstream-extension-aws-lambda
branch
from
b5d084a to
ba18381
Compare
zalimeni
deleted the
zalimeni/net-3900-only-apply-remote-upstream-extension-aws-lambda
branch
4 tasks
4 tasks
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
To avoid unintended tampering with remote downstreams via service config, refactor
BasicEnvoyExtenderandRuntimeConfigto disallow typical Envoy extensions from being applied to non-local proxies.Continue to allow this behavior for AWS Lambda and the read-only Validate builtin extensions.
Addresses CVE-2023-2816.
Description
This change addresses CVE-2023-2816 and prevents future bugs by refactoring Envoy extender code and
RuntimeConfigto:Testing & Reproduction steps
PR Checklist