(RHSA-2019:4222) Critical: Red Hat OpenShift Service Mesh 1.0.3 RPMs security update

Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

This advisory covers the RPM packages for the OpenShift Service Mesh 1.0.3 release.

Security Fix(es):

• An untrusted remote client may send HTTP/2 requests that write to the heap outside of the request buffers when the upstream is HTTP/1 (CVE-2019-18801)

• Malformed request header may cause bypass of route matchers resulting in escalation of privileges or information disclosure (CVE-2019-18802)

• Malformed HTTP request without the Host header may cause abnormal termination of the Envoy process (CVE-2019-18838)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.