Envoy proxy through 1.19.1 contains a vulnerability where a HTTP request with a fragment in the URI can bypass authorization policies.
This issue has been addressed in the following products: OpenShift Service Mesh 1.1 Via RHSA-2021:3273 https://access.redhat.com/errata/RHSA-2021:3273
This issue has been addressed in the following products: OpenShift Service Mesh 2.0 Via RHSA-2021:3272 https://access.redhat.com/errata/RHSA-2021:3272
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-32779