Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: Fix release notes for v1.15.1 release. #13318

Merged
merged 3 commits into from
Sep 30, 2020
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion VERSION
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.15.1
1.15.2
24 changes: 2 additions & 22 deletions docs/root/version_history/current.rst
Original file line number Diff line number Diff line change
@@ -1,26 +1,6 @@
1.15.1 (September 29, 2020)
1.15.2 (September 29, 2020)
===========================

Changes
-------
* http: fixed CVE-2020-25017. Previously header matching did not match on all headers for non-inline
headers. This patch changes the default behavior to always logically match on all headers.
Multiple individual headers will be logically concatenated with ',' similar to what is done with
inline headers. This makes the behavior effectively consistent. This behavior can be temporary
reverted by setting the runtime value `envoy.reloadable_features.header_match_on_all_headers` to
"false".

Targeted fixes have been additionally performed on the following extensions which make them
consider all duplicate headers by default as a comma concatenated list:
1. Any extension using CEL matching on headers.
2. The header to metadata filter.
3. The JWT filter.
4. The Lua filter.

Like primary header matching used in routing, RBAC, etc. this behavior can be disabled by setting
the runtime value `envoy.reloadable_features.header_match_on_all_headers` to false.
* http: the setCopy() header map API previously only set the first header in the case of duplicate
non-inline headers. setCopy() now behaves similarly to the other set*() APIs and replaces all found
headers with a single value. This may have had security implications in the extauth filter which
uses this API. This behavior can be disabled by setting the runtime value
`envoy.reloadable_features.http_set_copy_replace_all_headers` to false.
* docs: fix docs for v1.15.1.
27 changes: 27 additions & 0 deletions docs/root/version_history/v1.15.1.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
1.15.1 (September 29, 2020)
===========================

Changes
-------
* http: fixed CVE-2020-25017. Previously header matching did not match on all headers for non-inline
headers. This patch changes the default behavior to always logically match on all headers.
Multiple individual headers will be logically concatenated with ',' similar to what is done with
inline headers. This makes the behavior effectively consistent. This behavior can be temporary
reverted by setting the runtime value `envoy.reloadable_features.header_match_on_all_headers` to
"false".

Targeted fixes have been additionally performed on the following extensions which make them
consider all duplicate headers by default as a comma concatenated list:

1. Any extension using CEL matching on headers.
2. The header to metadata filter.
3. The JWT filter.
4. The Lua filter.

Like primary header matching used in routing, RBAC, etc. this behavior can be disabled by setting
the runtime value `envoy.reloadable_features.header_match_on_all_headers` to false.
* http: the setCopy() header map API previously only set the first header in the case of duplicate
non-inline headers. setCopy() now behaves similarly to the other set*() APIs and replaces all found
headers with a single value. This may have had security implications in the extauth filter which
uses this API. This behavior can be disabled by setting the runtime value
`envoy.reloadable_features.http_set_copy_replace_all_headers` to false.