Lucene search

RedHatRHSA-2020:3090

HistoryJul 22, 2020 - 7:59 a.m.

(RHSA-2020:3090) Moderate: Red Hat OpenShift Service Mesh 1.1 servicemesh-proxy security update

2020-07-2207:59:02

access.redhat.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

21.2%

JSON

Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

Security Fix(es):

envoyproxy/envoy: incorrectly validates TLS certificates when using wildcards for DNS SAN’s (CVE-2020-15104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat8x86_64servicemesh-proxy< 1.1.5-1.el8servicemesh-proxy-1.1.5-1.el8.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	8	x86_64	servicemesh-proxy	< 1.1.5-1.el8	servicemesh-proxy-1.1.5-1.el8.x86_64.rpm

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

21.2%

JSON

Related for RHSA-2020:3090