A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.
Important: Red Hat OpenShift Service Mesh Containers for 2.4.8 security update
Important: Red Hat OpenShift Service Mesh Containers for 2.6.2
Important: Red Hat OpenShift Service Mesh Containers for 2.5.5
Important: Red Hat OpenShift Service Mesh Containers for 2.4.11
Important: Red Hat OpenShift Service Mesh Containers for 2.5.6
Important: Red Hat OpenShift Service Mesh Containers for 2.4.14
Important: Red Hat OpenShift Service Mesh Containers for 2.5.8
Important: Red Hat OpenShift Service Mesh Containers for 2.6.5
Important: Red Hat OpenShift Service Mesh 2.2.10 security update
Important: Red Hat OpenShift Service Mesh for 2.4.4 security update
Important: Red Hat OpenShift Service Mesh for 2.3.8 security update
Important: Red Hat OpenShift Service Mesh for 2.2.11 security update
Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update
Important: Red Hat OpenShift Service Mesh 2.2.9 security update
Important: Red Hat OpenShift Service Mesh Containers for 2.3.6 security update
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application).
A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed.
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.1 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.2 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.6.3
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.7
The vulnerability arises due to insufficient sanitization of HTTP headers within the OpenShift Service Mesh, specifically allowing log injection attacks via the x-forwarded-for header. This could result in misleading log entries, potential XSS attacks, and misattribution of request sources. However, the impact is limited since it primarily affects logging and does not directly lead to remote code execution or privilege escalation.
Moderate: Red Hat OpenShift Service Mesh Containers for 2.5.10
Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.3 security update
Moderate: Red Hat OpenShift Service Mesh 2.2.8 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.4.1 security update
Moderate: Red Hat OpenShift Service Mesh Containers for 2.3.5 security update