CVE-2022-31045: Ill-formed headers may lead to unexpected behavior in Istio
A flaw was found in Istio. Memory access violation of ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access, resulting in undefined behavior or crashing.
Other sources
For an Envoy with HTTP Metadata Exchange enabled, a request with "X-Envoy-Peer-Metadata-Id" set and "X-Envoy-Peer-Metadata" unset can lead to unexpected memory access resulting in undefined behavior or crash.
— Red Hat
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-31045?
CVE-2022-31045 is a vulnerability in Istio that allows ill-formed headers sent to Envoy in certain configurations to result in memory access violations and unexpected behavior or crashes.
How does CVE-2022-31045 affect Istio?
CVE-2022-31045 affects Istio by allowing ill-formed headers to be sent to Envoy in certain configurations, potentially leading to memory access violations and undefined behavior or crashes.
What is the severity of CVE-2022-31045?
CVE-2022-31045 has a severity rating of critical.
How can I fix CVE-2022-31045?
To fix CVE-2022-31045, users should update their affected versions of Istio to the recommended remediation versions provided by Red Hat.
Where can I find more information about CVE-2022-31045?
More information about CVE-2022-31045 can be found on the CVE, NVD, and Istio websites, as well as the Red Hat Bugzilla and Errata pages.