(RHSA-2023:5175) Important: Red Hat OpenShift Service Mesh 2.2.10 security update

Red Hat OpenShift Service Mesh is Red Hat’s distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.

Security Fix(es):

• envoy: OAuth2 credentials exploit with permanent validity (CVE-2023-35941)

• envoy: Incorrect handling of HTTP requests and responses with mixed case schemes (CVE-2023-35944)

• envoy: HTTP/2 memory leak in nghttp2 codec (CVE-2023-35945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.