Vulnerabilities

Envoy is an open source edge and service proxy designed for cloud-native applications.

Axios is a promise based HTTP client for the browser and Node.js.

Immutable.js provides many Persistent Immutable data structures.

A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

A content spoofing vulnerability was found in Kiali.

A flaw was found in servicemesh-operator.

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7.

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0.

A signature verification vulnerability exists in crewjam/saml.

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using tha…

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1.

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.

CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e.

An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container.

Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass.

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0).