RHSA-2022:1275: Important: Red Hat OpenShift Service Mesh 2.1.2 security update
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio servicemesh project, tailored for installation into an on-premise OpenShift ContainerPlatform installation.This advisory covers the RPM packages for the release.Security Fix(es): envoy: Incorrect configuration handling allows mTLS session re-use without re-validation (CVE-2022-21654) envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655) istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726) envoy: Null pointer dereference when using JWT filter saferegex match (CVE-2021-43824) envoy: Use-after-free when response filters increase response data (CVE-2021-43825) envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826) envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606) istio: unauthenticated control plane denial of service attack (CVE-2022-23635) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:1275?
RHSA-2022:1275 has a severity rating that requires attention due to identified security vulnerabilities.
How do I fix RHSA-2022:1275?
To fix RHSA-2022:1275, you need to update the affected packages to versions 2.1.2-4.el8 or 2.23.0-5.el8 as specified in the advisory.
Which packages are affected by RHSA-2022:1275?
The affected packages include servicemesh, servicemesh-operator, servicemesh-prometheus, servicemesh-proxy, and servicemesh-ratelimit.
What vulnerabilities does RHSA-2022:1275 address?
RHSA-2022:1275 addresses multiple vulnerabilities related to the Envoy proxy used within Red Hat OpenShift Service Mesh.
Is there a workaround for RHSA-2022:1275?
There are no specific workarounds provided for RHSA-2022:1275; applying the updates is the recommended action.