Red Hat Security Advisory

RHSA-2021:1538

Red Hat OpenShift Service Mesh 2.0.4 security update

Released 2021-05-11 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Service Mesh 2.0 servicemesh-2.0.4-1.el8, servicemesh-istioctl-2.0.4-1.el8, servicemesh-mixc-2.0.4-1.el8 +5

Fixes 2 records

TI-2021-10204 CVE-2021-29492

Bypass of path matching rules using escaped slash characters

HIGH 71

Envoy is a cloud-native edge/middle/service proxy.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.63096 Published 2021-05-28 Fixed CWE-22

TI-2021-11908 CVE-2021-31920

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where…

LOW 32

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01316 Published 2021-05-27 Fixed CWE-706