Red Hat Security Advisory

RHSA-2020:0734

Red Hat OpenShift Service Mesh 1.0.9 servicemesh-proxy security update

Released 2020-03-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2020-06941 CVE-2020-8661

LOW 37

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01869 Published 2020-03-04 Fixed CWE-400

TI-2020-06939 CVE-2020-8659

LOW 37

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01887 Published 2020-03-04 Fixed CWE-770

TI-2020-06943 CVE-2020-8664

LOW 27

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.013 Published 2020-03-04 Fixed CWE-287

TI-2020-06940 CVE-2020-8660

LOW 25

CNCF Envoy through 1.13.0 TLS inspector bypass.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00606 Published 2020-03-04 Fixed CWE-345