Red Hat Security Advisory

RHSA-2020:2795

Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update

Released 2020-07-01 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Service Mesh 1.1 servicemesh-operator-1.1.4-3.el8

Fixes 2 records

TI-2019-08423 CVE-2019-11253 · GHSA-pmqp-h87c-mr78

Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

MEDIUM 54

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.25939 Published 2019-10-17 Partial fix · 1.13.12, 1.14.8 +2 CWE-20

TI-2020-11177 CVE-2020-14306

Missing authorization in openshift-service-mesh/istio-rhel8-operator

MEDIUM 41

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.013 Published 2020-09-16 Fixed CWE-862