Bug 1959481 (CVE-2021-31920)

Summary:	CVE-2021-31920 istio/istio: HTTP request with escaped slash characters can bypass authorization mechanisms
Product:	[Other] Security Response	Reporter:	Mark Cooper <mcooper>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	askrabec, jwendell, kconner, osoukup, rcernich, security-response-team, twalsh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	istio 1.9.5, istio 1.8.6	Doc Type:	If docs needed, set a value
Doc Text:	An authorization bypass flaw was found in Istio. This flaw allows an attacker to craft an HTTP request that defines a certain pattern of escaped characters in the URI path (such as %2F, %2f, %5C, or %5c), allowing them to bypass the authorization service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-13 08:34:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1921524, 1951189

Description Mark Cooper 2021-05-11 15:49:38 UTC

Istio through 1.9.5 contains a remotely exploitable vulnerability where an HTTP request with escaped slash characters can bypass authorization mechanisms. A subset of this security issue was addressed in the Envoy proxy, CVE-2021-29492.

Comment 3 Mark Cooper 2021-05-11 16:21:37 UTC

Statement:

This CVE addresses the specific fixes required in istio to support the vulnerability found in envoyproxy/envoy, CVE-2021-29492.

Comment 5 errata-xmlrpc 2021-05-11 23:28:40 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh 2.0

Via RHSA-2021:1538 https://access.redhat.com/errata/RHSA-2021:1538

Comment 6 errata-xmlrpc 2021-05-11 23:29:27 UTC

This issue has been addressed in the following products:

  OpenShift Service Mesh 1.1

Via RHSA-2021:1540 https://access.redhat.com/errata/RHSA-2021:1540

Comment 7 Mark Cooper 2021-05-12 01:23:16 UTC

External References:

https://istio.io/latest/news/security/istio-security-2021-005/

Comment 8 Mark Cooper 2021-05-13 03:57:50 UTC

Acknowledgments:

Name: the Istio Product Security Working Group

Comment 9 Product Security DevOps Team 2021-05-13 08:34:02 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-31920

Comment 10 Mark Cooper 2021-06-23 00:20:26 UTC

*** Bug 1921525 has been marked as a duplicate of this bug. ***