Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

redhat openshift service mesh 1.0 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Ietf Http 2.0Nghttp2 Nghttp2Netty NettyEnvoyproxy Envoy 1.27.0Envoyproxy Envoy 1.26.4Envoyproxy Envoy 1.25.9Envoyproxy Envoy 1.24.10Eclipse JettyCaddyserver CaddyGolang Http2Golang GoGolang NetworkingF5 Big-ip AnalyticsF5 Big-ip Policy Enforcement ManagerF5 Big-ip Local Traffic ManagerF5 Big-ip Link ControllerF5 Big-ip Global Traffic ManagerF5 Big-ip Fraud Protection ServiceF5 Big-ip Domain Name SystemF5 Big-ip Application Security ManagerF5 Big-ip Application Acceleration ManagerF5 Big-ip Advanced Firewall Manager
6.5
CVSSv2
CVE-2021-3495
An incorrect access control flaw was found in the kiali-operator in versions prior to 1.33.0 and prior to 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in...
Netlify Kiali-operatorRedhat Openshift Service Mesh 1.0Redhat Openshift Service Mesh 2.0
4
CVSSv2
CVE-2019-25014
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot prior to 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to t...
Istio IstioRedhat Openshift Service Mesh 1.0
7.5
CVSSv2
CVE-2020-1762
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to vi...
Kiali KialiRedhat Openshift Service Mesh 1.0
7.5
CVSSv2
CVE-2020-1764
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions before 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges t...
Kiali KialiRedhat Openshift Service Mesh 1.0
5
CVSSv2
CVE-2020-8659
CNCF Envoy up to and including 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
Cncf EnvoyRedhat Openshift Service Mesh 1.0Debian Debian Linux 9.0
7.5
CVSSv2
CVE-2020-8595
Istio versions 1.2.10 (End of Life) and prior, 1.3 up to and including 1.3.7, and 1.4 up to and including 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only acc...
Istio IstioRedhat Openshift Service Mesh 1.0
5
CVSSv2
CVE-2019-11253
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crash...
Kubernetes KubernetesRedhat Openshift Container Platform 3.9Redhat Openshift Container Platform 3.11Redhat Openshift Container Platform 3.10
7.8
CVSSv2
CVE-2019-9513
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consu...
Apple SwiftnioApache Traffic ServerCanonical Ubuntu Linux 16.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 19.04Debian Debian Linux 9.0Debian Debian Linux 10.0Fedoraproject Fedora 30Synology Skynas -Synology Diskstation Manager 6.2Synology Vs960hd Firmware -Fedoraproject Fedora 29Opensuse Leap 15.0Opensuse Leap 15.1Redhat Software Collections 1.0Redhat Jboss Core Services 1.0Redhat Enterprise Linux 8.0Redhat Jboss Enterprise Application Platform 7.2.0Redhat Quay 3.0.0Redhat Openshift Service Mesh 1.0Redhat Jboss Enterprise Application Platform 7.3.0Oracle Graalvm 19.2.0
7.8
CVSSv2
CVE-2019-9514
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer...
Apple SwiftnioApache Traffic ServerDebian Debian Linux 10.0Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 19.04Debian Debian Linux 9.0Synology Skynas -Synology Diskstation Manager 6.2Synology Vs960hd Firmware -Fedoraproject Fedora 29Fedoraproject Fedora 30Opensuse Leap 15.0Opensuse Leap 15.1Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server 7.0Redhat Software Collections 1.0Redhat Openshift Container Platform 3.9Redhat Openshift Container Platform 3.11Redhat Openshift Container Platform 3.10Redhat Jboss Core Services 1.0Redhat Enterprise Linux 8.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook