(RHSA-2022:5004) Critical: Red Hat OpenShift Service Mesh 2.1.3 security update

Red Hat OpenShift Service Mesh is a Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

This advisory covers the RPM packages for the release.

Security Fix(es):

• envoy: oauth filter allows trivial bypass (CVE-2022-29226)
• envoy: Decompressors can be zip bombed (CVE-2022-29225)
• envoy: oauth filter calls continueDecoding() from within decodeHeaders() (CVE-2022-29228)
• golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)
• golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)
• golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)
• envoy: Segfault in GrpcHealthCheckerImpl (CVE-2022-29224)
• Istio: Unsafe memory access in metadata exchange (CVE-2022-31045)

For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, see the CVE page listed in the References section.