CVE-2022-31045: Ill-formed headers may lead to unexpected behavior in Istio

Reference Links

• https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x
• https://istio.io/latest/news/security/istio-security-2022-05
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2095629
• https://access.redhat.com/errata/RHSA-2022:5004
• https://access.redhat.com/security/cve/cve-2022-31045
• https://bugzilla.redhat.com/show_bug.cgi?id=2088819
• https://www.cve.org/CVERecord?id=CVE-2022-31045 https://nvd.nist.gov/vuln/detail/CVE-2022-31045 https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x https://istio.io/latest/news/security/istio-security-2022-005/#cve-2022-31045

Parent vulnerabilities

(Appears in the following advisories)

• RHSA-2022:5004

Frequently Asked Questions

• What is CVE-2022-31045?

  CVE-2022-31045 is a vulnerability in Istio that allows ill-formed headers sent to Envoy in certain configurations to result in memory access violations and unexpected behavior or crashes.

• How does CVE-2022-31045 affect Istio?

  CVE-2022-31045 affects Istio by allowing ill-formed headers to be sent to Envoy in certain configurations, potentially leading to memory access violations and undefined behavior or crashes.

• What is the severity of CVE-2022-31045?

  CVE-2022-31045 has a severity rating of critical.

• How can I fix CVE-2022-31045?

  To fix CVE-2022-31045, users should update their affected versions of Istio to the recommended remediation versions provided by Red Hat.

• Where can I find more information about CVE-2022-31045?

  More information about CVE-2022-31045 can be found on the CVE, NVD, and Istio websites, as well as the Red Hat Bugzilla and Errata pages.