Istio through 1.11.0 contains a vulnerability where the authorization mechanism can be bypassed when using rules that specify `host` or `notHost` due to a case insensitive host comparison.
This issue has been addressed in the following products: OpenShift Service Mesh 1.1 Via RHSA-2021:3273 https://access.redhat.com/errata/RHSA-2021:3273
This issue has been addressed in the following products: OpenShift Service Mesh 2.0 Via RHSA-2021:3272 https://access.redhat.com/errata/RHSA-2021:3272
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-39155