Red Hat Security Advisory

RHSA-2021:1540

Red Hat OpenShift Service Mesh 1.1.14 security update

Released 2021-05-11 · Red Hat rating Important · View on Red Hat →

Fixed in

OpenShift Service Mesh 1.1 servicemesh-1.1.14-1.el8, servicemesh-citadel-1.1.14-1.el8, servicemesh-galley-1.1.14-1.el8 +7

Fixes 2 records

TI-2021-10204 CVE-2021-29492

Bypass of path matching rules using escaped slash characters

HIGH 71

Envoy is a cloud-native edge/middle/service proxy.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.63096 Published 2021-05-28 Fixed CWE-22

TI-2021-11908 CVE-2021-31920

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where…

LOW 32

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01316 Published 2021-05-27 Fixed CWE-706