CVE-2021-34824

A flaw was found in istio. Any client authorized to access Istio XDS API can retrieve any cached gateway TLS certificate and private keys. The highest threat from this vulnerability is to data confidentiality. Mitigation This vulnerability can be mitigated by disabling istiod caching. This is...

[ASA-202107-3] istio: information disclosure

Arch Linux Security Advisory ASA-202107-3 ========================================= Severity: Critical Date : 2021-07-01 CVE-ID : CVE-2021-34824 Package : istio Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-2113 Summary ======= The package istio before versi...

Privilege Escalation

github.com/istio/istio is vulnerable to privilege escalation. It does not prevent loading of private keys and certificates from Kubernetes secrets via the credentialName configuration...

CVE-2021-34824

Istio 1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces...

CVE-2021-34824

Istio 1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces...

Design/Logic Flaw

Istio 1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces...

CVE-2021-34824

CVE-2021-34824 affects Istio (versions in 1.8.x, 1.9.0–1.9.5, and 1.10.0–1.10.1) where credentials configured in Gateway and DestinationRule credentialName fields can be accessed from different namespaces via the Istio XDS API. The root issue allows unauthorized retrieval of TLS certificates and ...

CVE-2021-34824

Istio 1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces...

Istio 权限许可和访问控制问题漏洞

Istio is a set of open platforms for connecting, managing, and securing microservices. Istio is vulnerable to a privilege permission and access control issue that arises from an application that does not properly impose security restrictions. This vulnerability could allow an attacker to access...

Important: Red Hat Security Advisory: servicemesh-operator security update

An update for servicemesh-operator is now available for OpenShift Service Mesh 2.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2021-31921

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTOPASSTHROUGH routing configuration...

CVE-2021-31921

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTOPASSTHROUGH routing configuration...

CVE-2021-31921

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTOPASSTHROUGH routing configuration...

Design/Logic Flaw

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTOPASSTHROUGH routing configuration...

CVE-2021-31921

CVE-2021-31921 affects Istio in gateway AUTO_PASSTHROUGH mode via a remotely exploitable path that lets an external client access unintended services by bypassing authorization checks when using Istio versions prior to 1.9.5 (and 1.8.6 for the 1.8 branch). Connected advisories (RHSA entries) indi...

CVE-2021-31921

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTOPASSTHROUGH routing configuration...

olcne security update

coredns 1.7.0-1 - Added Oracle specific build files cri-o 1.18.4-2 - Fix for CVE-2021-27918 1.18.4-1 - Added Oracle Specifile Files for cri-o cri-tools 1.18.0-2 - Address CVE-2021-27918 etcd 3.4.3-1.0.5 - Address CVE-2021-27918 flannel 0.12.0-2 - Address CVE-2021-27918 yq 3.4.0-2 - Address...

Kiali 授权问题漏洞

Kiali is an open source, visual management tool for the Istio microservices architecture. Versions of Kiali prior to 1.31.0 suffer from an authorization issue vulnerability that stems from the fact that Kiali assumes that the underlying cluster handles some token validation when RBAC is enabled. ...

CVE-2021-31920

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters %2F or %5C could potentially bypass an Istio authorization policy when path based authorization rules are used...

CVE-2021-31920

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters %2F or %5C could potentially bypass an Istio authorization policy when path based authorization rules are used...