GHSA-fcrp-7gc2-93g7
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass
Quick fix
GHSA-fcrp-7gc2-93g7 — github.com/envoyproxy/gateway: upgrade to the fixed version with the command below.
go get github.com/envoyproxy/gateway@v1.8.1Details
### Impact Envoy Gateway accepts extension-managed custom backendRefs from an HTTPRoute to a backend resource in another namespace without requiring a matching Gateway API ReferenceGrant in the target namespace. This breaks the Gateway API cross-namespace consent model: the namespace that owns the referenced backend resource does not need to opt in with a ReferenceGrant before another namespace’s HTTPRoute can use that resource.
### Patches [1.7.4](https://github.com/envoyproxy/gateway/releases/tag/v1.7.4) [1.8.1](https://github.com/envoyproxy/gateway/releases/tag/v1.8.1)
Are you affected?
Enter the version of the package you're using.
Affected packages
1.8.0-rc.0Fixed in: 1.8.1go get github.com/envoyproxy/gateway@v1.8.10Fixed in: 1.7.4go get github.com/envoyproxy/gateway@v1.7.4