Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.10

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): kiali-ossmc-container: Mutation XSS in DOMPurify Due to Improper Template Literal Handling (CVE-2025-26791) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat OpenShift Service Mesh Containers for 2.4.14

Important: Red Hat OpenShift Service Mesh Containers for 2.5.8

Important: Red Hat OpenShift Service Mesh Containers for 2.6.5

The vulnerability arises due to insufficient sanitization of HTTP headers within the OpenShift Service Mesh, specifically allowing log injection attacks via the x-forwarded-for header. This could result in misleading log entries, potential XSS attacks, and misattribution of request sources. However, the impact is limited since it primarily affects logging and does not directly lead to remote code execution or privilege escalation.

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.

Low: Red Hat OpenShift Service Mesh Containers for 2.4.13

Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.7

Important: Red Hat OpenShift Service Mesh Containers for 2.5.6

Moderate: Red Hat OpenShift Service Mesh Containers for 2.6.3

Important: Red Hat OpenShift Service Mesh Containers for 2.6.2

Important: Red Hat OpenShift Service Mesh Containers for 2.5.5

Important: Red Hat OpenShift Service Mesh Containers for 2.4.11

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): quic-go: memory exhaustion attack against QUIC's connection ID mechanism(CVE-2024-22189) moby: cert signing bypass(CVE-2018-12608) golang: archive/zip: Incorrect handling of certain ZIP files(CVE-2024-24789) jose: resource exhaustion(CVE-2024-28176) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat OpenShift Service Mesh Containers for 2.4.8 security update

Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.2 security update

Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.1 security update

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.Security Fix(es): golang: net/http, x/net/http2: rapid stream resets can cause excessive work (Rapid Reset Attack) (CVE-2023-39325) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487) A Red Hat Security Bulletin which addresses further details about the Rapid Reset flaw is available in the References section.For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Important: Red Hat OpenShift Service Mesh for 2.4.4 security update

Important: Red Hat OpenShift Service Mesh for 2.3.8 security update

Important: Red Hat OpenShift Service Mesh for 2.2.11 security update

Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.3 security update

Important: Red Hat OpenShift Service Mesh 2.2.10 security update

Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update

Important: Red Hat OpenShift Service Mesh 2.2.9 security update

Important: Red Hat OpenShift Service Mesh Containers for 2.3.6 security update

Moderate: Red Hat OpenShift Service Mesh 2.2.8 security update

Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.1 security update

Moderate: Red Hat OpenShift Service Mesh Containers for 2.3.5 security update