Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatRedHatRHSA-2021:1538
HistoryMay 11, 2021 - 11:06 p.m.

(RHSA-2021:1538) Important: Red Hat OpenShift Service Mesh 2.0.4 security update

2021-05-1123:06:43
access.redhat.com
60
red hat openshift service mesh
istio service mesh
security update
cve-2021-29492
cve-2021-31920
authorization bypass

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS

0.004

Percentile

73.9%

JSON

Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

Security Fix(es):

  • envoyproxy/envoy: HTTP request with escaped slash characters can bypass Envoy’s authorization mechanisms (CVE-2021-29492)

  • istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms (CVE-2021-31920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHat8ppc64leservicemesh-proxy< 2.0.4-1.el8servicemesh-proxy-2.0.4-1.el8.ppc64le.rpm
RedHat8s390xservicemesh-operator< 2.0.4-3.el8servicemesh-operator-2.0.4-3.el8.s390x.rpm
RedHat8s390xservicemesh-mixs< 2.0.4-1.el8servicemesh-mixs-2.0.4-1.el8.s390x.rpm
RedHat8s390xservicemesh-proxy< 2.0.4-1.el8servicemesh-proxy-2.0.4-1.el8.s390x.rpm
RedHat8ppc64leservicemesh-pilot-agent< 2.0.4-1.el8servicemesh-pilot-agent-2.0.4-1.el8.ppc64le.rpm
RedHat8s390xservicemesh-mixc< 2.0.4-1.el8servicemesh-mixc-2.0.4-1.el8.s390x.rpm
RedHat8ppc64leservicemesh-mixs< 2.0.4-1.el8servicemesh-mixs-2.0.4-1.el8.ppc64le.rpm
RedHat8s390xservicemesh-pilot-discovery< 2.0.4-1.el8servicemesh-pilot-discovery-2.0.4-1.el8.s390x.rpm
RedHat8x86_64servicemesh-operator< 2.0.4-3.el8servicemesh-operator-2.0.4-3.el8.x86_64.rpm
RedHat8ppc64leservicemesh-mixc< 2.0.4-1.el8servicemesh-mixc-2.0.4-1.el8.ppc64le.rpm
Rows per page:
1-10 of 241

Related

redhatcve 2
nessus 7
redhat 1
prion 2
cvelist 2
osv 4
nvd 2
cnvd 1
veracode 2
cve 2
photon 2
github 1
oraclelinux 4
redhatcve
redhatcve
CVE-2021-31920
2021-05-11 20:55:56
CVE-2021-29492
2021-05-11 20:55:48
nessus
nessus
RHEL 8 : Red Hat OpenShift Service Mesh 1.1.14 (RHSA-2021:1540)
2021-05-13 00:00:00
RHEL 8 : Red Hat OpenShift Service Mesh 2.0.4 (RHSA-2021:1538)
2021-05-12 00:00:00
Photon OS 1.0: Envoy PHSA-2021-1.0-0405
2021-06-22 00:00:00
redhat
redhat
(RHSA-2021:1540) Important: Red Hat OpenShift Service Mesh 1.1.14 security update
2021-05-11 23:07:47
prion
prion
Path traversal
2021-05-28 21:15:00
Path traversal
2021-05-27 05:15:00
cvelist
cvelist
CVE-2021-31920
2021-05-27 04:03:31
CVE-2021-29492 Bypass of path matching rules using escaped slash characters
2021-05-28 21:00:24
osv
osv
CVE-2021-31920
2021-05-27 05:15:06
BIT-envoy-2021-29492
2024-03-06 10:58:39
CVE-2021-29492
2021-05-28 21:15:08
nvd
nvd
CVE-2021-29492
2021-05-28 21:15:08
CVE-2021-31920
2021-05-27 05:15:06
cnvd
cnvd
Envoy path traversal vulnerability
2021-05-17 00:00:00
veracode
veracode
Privilege Escalation
2021-05-13 10:28:49
Privilege Escalation
2021-05-13 10:28:52
cve
cve
CVE-2021-29492
2021-05-28 21:15:08
CVE-2021-31920
2021-05-27 05:15:06
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2021-1.0-0405
2021-06-19 00:00:00
Critical Photon OS Security Update - PHSA-2021-0405
2021-06-19 00:00:00
github
github
Istio Authorization Bypass Vulnerability
2022-05-24 19:03:32
oraclelinux
oraclelinux
olcne security update
2021-08-06 00:00:00
olcne security update
2021-08-06 00:00:00
olcne security update
2021-08-06 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS

0.004

Percentile

73.9%

JSON
Related for RHSA-2021:1538
redhatcve2nessus7redhat1prion2cvelist2osv4nvd2cnvd1veracode2cve2photon2github1oraclelinux4