PT-2020-12825 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Istio versions 1.5.1 and earlier Envoy versions 1.14.1 and earlier Description: The issue concerns a data-leak problem where a TCP connection negotiated with SNI over HTTPS to .example.com can lead to a request for a domain configured...

Envoy and Istio Information Disclosure Vulnerabilities

Envoy is an open source distributed proxy server.Istio is an open platform for connecting, managing and securing microservices. An information disclosure vulnerability exists in Istio 1.5.1 and earlier versions and Envoy 1.14.1 and earlier versions. An attacker can exploit the vulnerability to...

Important: Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 1.1.0 RPMs

Red Hat OpenShift Service Mesh 1.1.0. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. The OpenShift Service Mesh release notes provide information on the features an...

istio/envoy: mishandling regular expressions for long URIs leading to DoS

A flaw was found in Istio in versions prior to 1.1.13 and 1.2.4. Regular expressions for long URIs are mishandled leading to a denial of service during the use of JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API. The highest threat from this vulnerability is to system availability...

CVE-2020-1764

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alte...

CVE-2020-1764

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alte...

Hardcoded credentials

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alte...

CVE-2020-1764

CVE-2020-1764 concerns a hard-coded cryptographic key in Kiali’s default config, affecting all versions

CVE-2020-1764

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alte...

Kiali Trust Management Issues Vulnerabilities

Kiali is an open source, visual management tool for the Istio microservices architecture. A trust management issue vulnerability exists in the default configuration file in versions of Kiali prior to 1.15.1. The vulnerability stems from the fact that the file comes with a hard-coded encryption ke...

Kiali has an unspecified vulnerability

Kiali is an open source, visual management tool for the Istio microservices architecture. A security vulnerability exists in kiali, which can be exploited by a remote attacker to gain privileges, view and modify the Istio configuration by stealing a valid JWT cookie and spoofing a user session...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.10 openshift-istio-kiali-rhel7-operator-container security update

An update for openshift-istio-kiali-rhel7-operator-container is now available for Openshift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2020-1762

An insufficient JWT validation vulnerability was found in Kiali, versions 0.4.0 to 1.15.0. A remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration...

CVE-2020-1764

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.10 Jaeger and Kiali security update

An update for Jaeger and Kiali is now available for Openshift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

kiali: ignoring JWT claim fields

An insufficient JWT validation vulnerability was found in Kiali, versions 0.4.0 to 1.15.0. A remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.9 servicemesh-proxy security update

Red Hat OpenShift Service Mesh 1.0.9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

Authorization Bypass

github.com/istio/api is vulnerable to authorization bypass. The vulnerability exists as Istio improperly handles forwarded attributes, allowing it to accept x-istio-attributes header during ingress. When used with the Mixer Policy enabled, it can result in different policy decisions...

Unspecified Vulnerability in Istio

Istio is a set of open platforms for connecting, managing and securing microservices. A security vulnerability exists in Istio versions 1.3 through 1.3.6. An attacker can exploit the vulnerability by encoding the source.uid in the x-istio-attributes header to bypass the configured Mixer policy...

CVE-2020-8843

An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a...