Red Hat Security Advisory

RHSA-2021:1322

Red Hat OpenShift Service Mesh 1.1.13 security update

Released 2021-04-22 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Service Mesh 1.1 servicemesh-pilot-agent-1.1.13-3.el8, servicemesh-pilot-discovery-1.1.13-3.el8, servicemesh-proxy-1.1.13-1.el8

TI-2021-09748 CVE-2021-28682

LOW 37

An issue was discovered in Envoy through 1.71.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0204 Published 2021-05-20 Fixed CWE-190

TI-2021-10069 CVE-2021-29258

LOW 36

An issue was discovered in Envoy 1.14.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01772 Published 2021-05-20 Fixed CWE-617

TI-2021-09749 CVE-2021-28683

LOW 36

An issue was discovered in Envoy through 1.71.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01686 Published 2021-05-20 Fixed CWE-476

TI-2019-15154 CVE-2019-25014

LOW 32

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01345 Published 2021-01-29 Fixed CWE-476