End of life: 4/16/2025, Latest version: 1.23.6
End of life: 4/16/2025, Latest version: 1.23.6
End of life: 1/22/2025, Latest version: 1.22.8
End of life: 1/22/2025, Latest version: 1.22.8
End of life: 6/25/2024, Latest version: 1.20.8
End of life: 6/25/2024, Latest version: 1.20.8
End of life: 4/24/2024, Latest version: 1.19.10
End of life: 4/24/2024, Latest version: 1.19.10
End of life: 1/4/2024, Latest version: 1.18.7
End of life: 1/4/2024, Latest version: 1.18.7
End of life: 10/27/2023, Latest version: 1.17.8
End of life: 10/27/2023, Latest version: 1.17.8
End of life: 7/25/2023, Latest version: 1.16.7
End of life: 7/25/2023, Latest version: 1.16.7
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
An uncontrolled resource consumption flaw was found in the Istio control plane, istiod. This issue could allow an unauthenticated remote attacker to send a specially crafted or oversized message that could cause a denial of service.
End of life: 4/4/2023, Latest version: 1.15.7
End of life: 4/4/2023, Latest version: 1.15.7
End of life: 12/27/2022, Latest version: 1.14.6
End of life: 12/27/2022, Latest version: 1.14.6
A flaw was found in Istio. Memory access violation of ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access, resulting in undefined behavior or crashing.
A stack exhaustion flaw was found in the Istio control plane. This flaw allows a remote unauthenticated attacker to send a specially crafted or oversized message to crash the control plane process, resulting in a denial of service condition.
End of life: 10/12/2022, Latest version: 1.13.9
End of life: 10/12/2022, Latest version: 1.13.9
Istio is an open platform to connect, manage, and secure microservices. In versions 1.12.0 and 1.12.1 Istio is vulnerable to a privilege escalation attack. Users who have CREATE permission for gateways.gateway.networking.k8s.io objects can escalate this privilege to create other resources that they may not have access to, such as Pod. This vulnerability impacts only an Alpha level feature, the Kubernetes Gateway API. This is not the same as the Istio Gateway type (gateways.networking.istio.io), which is not vulnerable. Users are advised to upgrade to resolve this issue. Users unable to upgrade should implement any of the following which will prevent this vulnerability: Remove the gateways.gateway.networking.k8s.io CustomResourceDefinition, set PILOTENABLEGATEWAYAPIDEPLOYMENTCONTROLLER=true environment variable in Istiod, or remove CREATE permissions for gateways.gateway.networking.k8s.io objects from untrusted users.
Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.
End of life: 7/12/2022, Latest version: 1.12.9
End of life: 7/12/2022, Latest version: 1.12.9
End of life: 3/25/2022, Latest version: 1.11.8
End of life: 3/25/2022, Latest version: 1.11.8