Red Hat Security Advisory

RHSA-2023:0542

Red Hat OpenShift Service Mesh 2.3.1 Containers security update

Released 2023-01-30 · Red Hat rating Important · View on Red Hat →

Fixed in

RHOSSM 2.3 for RHEL 8 openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-rhel8-operator, openshift-service-mesh/kiali-rhel8 +4

Fixes 8 records

TI-2021-03097 CVE-2021-4238 · GHSA-xg2h-wx96-xgxr

Insufficient randomness in github.com/Masterminds/goutils

MEDIUM 50

Randomly-generated alphanumeric strings contain significantly less entropy than expected.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01408 Published 2022-12-27 Partial fix · 1.1.1 CWE-331

TI-2022-13904 CVE-2022-32189 · GHSA-3rm2-w8f7-h7rf

Panic when decoding Float and Rat types in math/big

MEDIUM 44

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02781 Published 2022-08-09 Partial fix · 1.17.13, 1.18.5

TI-2022-18654 CVE-2022-39278

Istio vulnerable to denial of service attack due to Golang Regex Library

MEDIUM 42

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01436 Published 2022-10-13 Partial fix · 1.13.9, 1.14.5 +1 CWE-400

TI-2022-10644 CVE-2022-27664 · GHSA-69cg-p879-7622

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of…

LOW 39

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03487 Published 2022-09-06 Partial fix · 0.0.0-20220906165146-f3363e06e74c

TI-2022-02669 CVE-2022-2879 · GHSA-fqpx-62jv-7r6r

Unbounded memory consumption when reading headers in archive/tar

LOW 37

Reader.Read does not set a limit on the maximum size of file headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02006 Published 2022-10-14 Partial fix · 1.18.7, 1.19.2 CWE-770

TI-2022-20107 CVE-2022-41715 · GHSA-5wvm-rxcf-6cg8

Memory exhaustion when compiling regular expressions in regexp/syntax

LOW 36

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01726 Published 2022-10-14 Partial fix · 1.18.7, 1.19.2

TI-2022-02670 CVE-2022-2880 · GHSA-m3hq-grv6-h853

Incorrect sanitization of forwarded query parameters in net/http/httputil

LOW 36

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01408 Published 2022-10-14 Partial fix · 1.18.7, 1.19.2 CWE-444

TI-2022-03631 CVE-2022-3962 · GHSA-6f4m-j56w-55c3

Kiali: error message spoofing in kiali ui

LOW 21

A content spoofing vulnerability was found in Kiali.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00738 Published 2023-09-23 Partial fix · 1.57.5-3, 1.57.4 CWE-74