(RHSA-2022:1739) Moderate: Red Hat OpenShift Service Mesh 2.1.2.1 containers security update

Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

This advisory covers the containers for the release.

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)
• node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
• follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536)
• node-forge: Signature verification leniency in checking digestAlgorithm structure can lead to signature forgery (CVE-2022-24771)
• node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery (CVE-2022-24772)
• node-forge: Signature verification leniency in checking DigestInfo structure (CVE-2022-24773)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.