(RHSA-2021:1322) Important: Red Hat OpenShift Service Mesh 1.1.13 security update

Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

Security Fix(es):

• envoyproxy/envoy: integer overflow handling large grpc-timeouts (CVE-2021-28682)

• envoyproxy/envoy: NULL pointer dereference in TLS alert code handling (CVE-2021-28683)

• envoyproxy/envoy: crash with empty HTTP/2 metadata map (CVE-2021-29258)

• istio-pilot: requests to debug api can result in panic (CVE-2019-25014)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.