The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message, to crash the control plane process. This can be exploited when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from an attacker. Security advisory: https://istio.io/latest/news/security/istio-security-2022-004. Upstream commits/PRs: [master] https://github.com/istio/istio/commit/40f6caed64e6869a5589f2e2f38f1e64063fd930 [1.11] https://github.com/istio/istio/pull/37804 https://github.com/istio/istio/commit/458feb160756d6b38f1cee4ddb7a40ff50aaa713 [1.12] https://github.com/istio/istio/pull/37791 https://github.com/istio/istio/commit/e9c3781bd4097f94289b18ecb5a657438f47c9a4 [1.13] https://github.com/istio/istio/pull/37792 https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd
This issue has been addressed in the following products: OpenShift Service Mesh 2.0 Via RHSA-2022:1276 https://access.redhat.com/errata/RHSA-2022:1276
This issue has been addressed in the following products: OpenShift Service Mesh 2.1 Via RHSA-2022:1275 https://access.redhat.com/errata/RHSA-2022:1275
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-24726