A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade kata-imageUpgrade istio-sidecar-injectorUpgrade olcne-prometheus-chartUpgrade istio-galleyUpgrade kernel-uek-containerUpgrade istio-proxy-initUpgrade kata-runtimeUpgrade istio-pilot-discoveryUpgrade olcneUpgrade istio-mixcUpgrade istio-istioctlUpgrade olcne-agentUpgrade olcne-api-serverUpgrade olcne-istio-chartUpgrade istio-pilot-agentUpgrade istioUpgrade olcnectlUpgrade istio-node-agentUpgrade kubectlUpgrade kataUpgrade kubeletUpgrade istio-citadelUpgrade kubeadmUpgrade olcne-nginxUpgrade istio-mixsUpgrade kubernetesUpgrade olcne-utils | Jul 23, 2020 | Mar 26, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub