775 matches found
CVE-2020-8843
An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a...
Design/Logic Flaw
An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a...
CVE-2020-8843
An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a...
CVE-2020-8843
CVE-2020-8843 affects Istio 1.3–1.3.6. The issue lets an attacker bypass a configured Mixer policy by abusing the x-istio-attributes header at ingress; exploitation requires encoding a source.uid in the header, which influences policy decisions when Mixer policy applies to ingress source. The vul...
Authentication Bypass
github.com/istio/proxy is vulnerable to authentication bypass. The vulnerability exists as the Authentication Policy's exact-path matching logic allows unauthorized access to HTTP paths using an invalid JWT token...
RHEL 8 : Red Hat OpenShift Service Mesh 1.0.7 servicemesh-proxy (RHSA-2020:0477)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:0477 advisory. Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift...
CVE-2020-8595
Istio versions 1.2.10 End of Life and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. F...
CVE-2020-8595
Istio versions 1.2.10 End of Life and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. F...
Authentication flaw
Istio versions 1.2.10 End of Life and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. F...
CVE-2020-8595
CVE-2020-8595 affects Istio: authentication bypass via the Authentication Policy exact-path matching logic in Istio versions 1.2.10 (End of Life) and earlier, 1.3.x up to 1.3.7, and 1.4.x up to 1.4.3. An attacker can gain unauthorized access to HTTP paths configured to require a valid JWT by mani...
CVE-2020-8595
Istio versions 1.2.10 End of Life and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. F...
istio: unauthorised access to JWT protected HTTP path
An unauthorized access vulnerability was found in Istio in the servicemesh-proxy. An attacker can use this flaw to specify an HTTP path and gain unauthorized access, even if the path is configured to only be accessed with a valid JSON Web Token JWT...
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.7 servicemesh-proxy security update
Red Hat OpenShift Service Mesh 1.0.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...
CVE-2020-8595
An unauthorized access vulnerability was found in Istio in the servicemesh-proxy. An attacker can use this flaw to specify an HTTP path and gain unauthorized access, even if the path is configured to only be accessed with a valid JSON Web Token JWT. Mitigation Depending on the paths used in the...
Critical: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.3 RPMs security update
Red Hat OpenShift Service Mesh 1.0.3. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...
Envoy CVE-2019-18801 Heap Buffer Overflow Vulnerability
Description Envoy PHP is prone to a heap-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Successfully exploiting this issue allows attackers to execute arbitrary code in the contex...
Wallarm Launches Support of Envoy Proxy/ Envoy API Protection
Wallarm can protect North-South API in the applications that use Envoy as an alternative Ingress controller at the front end of a Kubernetes cluster. Wallarm can also protect edge traffic and also East-West Envoy API for Service-Mesh and Istio. The post Wallarm Launches Support of Envoy Proxy/...
Istio Denial of Service Vulnerability
Istio is a set of open platforms for connecting, managing and securing microservices. A denial of service vulnerability exists in version 1.3.x of Istio prior to 1.3.5, which can be exploited by an attacker to cause a denial of service...
Istio CVE-2019-18817 Remote Denial of Service Vulnerability
Description Istio is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the application to crash, denying service to legitimate users. Istio versions prior to 1.3.5 are vulnerable. Technologies Affected Istio Istio 1.3.0 Istio Istio 1.3.1 Istio Istio...