Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade istio-sidecar-injectorUpgrade kernel-uek-containerUpgrade olcnectlUpgrade istioUpgrade kata-runtimeUpgrade istio-node-agentUpgrade olcne-utilsUpgrade istio-istioctlUpgrade kubeletUpgrade olcne-prometheus-chartUpgrade istio-proxy-initUpgrade istio-pilot-discoveryUpgrade kubernetesUpgrade olcne-api-serverUpgrade istio-mixsUpgrade kataUpgrade kubeadmUpgrade kata-imageUpgrade istio-mixcUpgrade istio-citadelUpgrade olcne-agentUpgrade kubectlUpgrade istio-pilot-agentUpgrade olcne-nginxUpgrade olcneUpgrade istio-galleyUpgrade olcne-istio-chart | Jul 23, 2020 | Jun 2, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub