Lucene search
RedHatRHSA-2023:4625HistoryAug 11, 2023 - 4:45 p.m.
(RHSA-2023:4625) Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update
2023-08-1116:45:31
access.redhat.com
10
red hat
istio
service mesh
security update
oauth2
http requests
cors filter
cve-2023-35941
cve-2023-35944
cve-2023-35943
cvss score
0.001 Low
EPSS
Percentile
47.8%
Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
-
envoy: OAuth2 credentials exploit with permanent validity (CVE-2023-35941)
-
envoy: Incorrect handling of HTTP requests and responses with mixed case schemes (CVE-2023-35944)
-
envoy: CORS filter segfault when origin header is removed (CVE-2023-35943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Related
redhat
redhat
(RHSA-2023:4624) Important: Red Hat OpenShift Service Mesh Containers for 2.3.6 security update
2023-08-11 16:44:55
(RHSA-2023:4037) Important: bind9.16 security update
2023-07-12 07:52:23
(RHSA-2023:4102) Important: bind security update
2023-07-17 08:08:17
nessus
nessus
Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-300)
2023-08-24 00:00:00
Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-006)
2023-09-06 00:00:00
Oracle Linux 9 : istio (ELSA-2023-12771)
2023-09-18 00:00:00
oraclelinux
oraclelinux
istio security update
2023-09-08 00:00:00
istio security update
2023-09-08 00:00:00
istio security update
2023-09-06 00:00:00
veracode
veracode
Improper Authorization
2023-07-27 10:25:56
Denial Of Service (DoS)
2023-07-27 10:39:08
Authentication Bypass
2023-07-27 09:42:47
cvelist
cvelist
nvd
nvd
cve
cve
redhatcve
redhatcve
osv
osv
CVE-2023-35943
2023-07-25 19:15:11
BIT-envoy-2023-35943
2024-03-06 10:52:59
BIT-envoy-2023-35941
2024-03-06 10:53:21
alpinelinux
alpinelinux
CVE-2023-35945
2023-07-13 21:15:08
cbl_mariner
cbl_mariner
CVE-2023-35945 affecting package nodejs18 for versions less than 18.17.1-2
2023-09-27 18:02:50
CVE-2023-35945 affecting package nghttp2 for versions less than 1.46.0-3
2023-08-03 02:51:21
CVE-2023-35945 affecting package cmake for versions less than 3.21.4-8
2023-09-27 18:02:50
openvas
openvas
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2023-3015)
2023-10-31 00:00:00
Huawei EulerOS: Security Advisory for nghttp2 (EulerOS-SA-2023-3478)
2023-12-22 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:3842-1)
2023-09-28 00:00:00
prion
prion
Design/Logic Flaw
2023-07-25 18:15:00
Memory corruption
2023-07-13 21:15:00
Design/Logic Flaw
2023-07-25 19:15:00
amazon
amazon
Important: nghttp2
2023-08-03 20:16:00
Important: nghttp2
2023-08-03 18:09:00
Important: bind
2023-07-05 22:01:00
rocky
rocky
bind9.16 security update
2023-08-08 12:34:07
bind security update
2023-08-08 12:33:57
bind security update
2023-08-08 12:34:57
almalinux
almalinux
Important: bind security update
2023-07-17 00:00:00
Important: bind9.16 security update
2023-07-17 00:00:00
Important: bind security update
2023-07-17 00:00:00
ibm
ibm
ubuntucve
ubuntucve
CVE-2023-2828
2023-06-21 00:00:00
aix
aix
AIX is vulnerable to denial of service due to ISC BIND
2023-09-07 13:08:07
centos
centos
bind security update
2023-08-03 14:24:41
f5
f5
K000135312 : BIND vulnerability CVE-2023-2828
2023-06-30 00:00:00
debian
debian
[SECURITY] [DLA 3498-1] bind9 security update
2023-07-19 09:38:19
debiancve
debiancve
CVE-2023-2828
2023-06-21 17:15:47