GHSA-w9mr-28mw-j8hg Hop-by-hop abuse to malform header mutator

• Go github.com/ory/oathkeeper: < 0.40.3 → fixed in 0.40.3

Impact Downstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config: ```yaml • id: 'example' upstream: url: 'https://example.com' match: url: 'http://127.0.0.1:4455/' methods: • GET authenticators: • handler: anonymous authorizer: handler: allow mutators: • handler: header config: headers: X-Subject: {{ .Subject }} ``` ``` curl -H "Connection: close,x-subject" http://127.0.0.1:4455/ ``` The `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name. Patches c5cc7f736dc84185034be4356057d1c7a656d797 Workarounds The downstream server should handle the case that an expected header is not set by responding with an appropriate error. References See background info in https://github.com/golang/go/issues/50580