Skip to content

Commit

Permalink
docs: Fix release notes for v1.15.1 release. (#13318)
Browse files Browse the repository at this point in the history
Signed-off-by: Antonio Vicente <[email protected]>
  • Loading branch information
antoniovicente authored Sep 30, 2020
1 parent 670a4a6 commit c2a3cbd
Show file tree
Hide file tree
Showing 3 changed files with 30 additions and 23 deletions.
2 changes: 1 addition & 1 deletion VERSION
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.15.1
1.15.2
24 changes: 2 additions & 22 deletions docs/root/version_history/current.rst
Original file line number Diff line number Diff line change
@@ -1,26 +1,6 @@
1.15.1 (September 29, 2020)
1.15.2 (September 29, 2020)
===========================

Changes
-------
* http: fixed CVE-2020-25017. Previously header matching did not match on all headers for non-inline
headers. This patch changes the default behavior to always logically match on all headers.
Multiple individual headers will be logically concatenated with ',' similar to what is done with
inline headers. This makes the behavior effectively consistent. This behavior can be temporary
reverted by setting the runtime value `envoy.reloadable_features.header_match_on_all_headers` to
"false".

Targeted fixes have been additionally performed on the following extensions which make them
consider all duplicate headers by default as a comma concatenated list:
1. Any extension using CEL matching on headers.
2. The header to metadata filter.
3. The JWT filter.
4. The Lua filter.

Like primary header matching used in routing, RBAC, etc. this behavior can be disabled by setting
the runtime value `envoy.reloadable_features.header_match_on_all_headers` to false.
* http: the setCopy() header map API previously only set the first header in the case of duplicate
non-inline headers. setCopy() now behaves similarly to the other set*() APIs and replaces all found
headers with a single value. This may have had security implications in the extauth filter which
uses this API. This behavior can be disabled by setting the runtime value
`envoy.reloadable_features.http_set_copy_replace_all_headers` to false.
* docs: fix docs for v1.15.1.
27 changes: 27 additions & 0 deletions docs/root/version_history/v1.15.1.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
1.15.1 (September 29, 2020)
===========================

Changes
-------
* http: fixed CVE-2020-25017. Previously header matching did not match on all headers for non-inline
headers. This patch changes the default behavior to always logically match on all headers.
Multiple individual headers will be logically concatenated with ',' similar to what is done with
inline headers. This makes the behavior effectively consistent. This behavior can be temporary
reverted by setting the runtime value `envoy.reloadable_features.header_match_on_all_headers` to
"false".

Targeted fixes have been additionally performed on the following extensions which make them
consider all duplicate headers by default as a comma concatenated list:

1. Any extension using CEL matching on headers.
2. The header to metadata filter.
3. The JWT filter.
4. The Lua filter.

Like primary header matching used in routing, RBAC, etc. this behavior can be disabled by setting
the runtime value `envoy.reloadable_features.header_match_on_all_headers` to false.
* http: the setCopy() header map API previously only set the first header in the case of duplicate
non-inline headers. setCopy() now behaves similarly to the other set*() APIs and replaces all found
headers with a single value. This may have had security implications in the extauth filter which
uses this API. This behavior can be disabled by setting the runtime value
`envoy.reloadable_features.http_set_copy_replace_all_headers` to false.

0 comments on commit c2a3cbd

Please sign in to comment.