CVE-2019-12995: Null Pointer Dereference
Published Jun 28, 2019
·Updated
Istio before 1.2.2 mishandles certain access tokens, leading to "Epoch 0 terminated with an error" in Envoy. This is related to a jwtauthenticator.cc segmentation fault.
Affected Software
1 affected component
Istio Istio<1.2.2
Event History
Jun 28, 2019
CVE Published
via MITRE·09:55 AM
Data Sourced
via MITRE·09:55 AM
Description
Frequently Asked Questions
1
What is CVE-2019-12995?
CVE-2019-12995 is a vulnerability that affects Istio before version 1.2.2 and results in a segmentation fault in Envoy due to mishandling of certain access tokens.
2
How severe is CVE-2019-12995?
CVE-2019-12995 has a severity value of 7.5, which is considered high.
3
Which software versions are affected by CVE-2019-12995?
Istio versions up to and excluding 1.2.2 are affected by CVE-2019-12995.
4
How can I fix CVE-2019-12995?
To fix CVE-2019-12995, upgrade your Istio installation to version 1.2.2 or later.
5
Where can I find more information about CVE-2019-12995?
You can find more information about CVE-2019-12995 in the references provided: [link1], [link2], [link3].