redhat openshift service mesh vulnerabilities and exploits

(subscribe to this query)

6.5

CVSSv2

An incorrect access control flaw was found in the kiali-operator in versions prior to 1.33.0 and prior to 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in...

Netlify Kiali-operator Redhat Openshift Service Mesh 1.0 Redhat Openshift Service Mesh 2.0

4.6

CVSSv2

An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) prior to 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd an...

Redhat Openshift Service Mesh

7.5

CVSSv2

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorize...

Envoyproxy Envoy Redhat Openshift Service Mesh -

1 Github repository

5

CVSSv2

CNCF Envoy up to and including 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.

Cncf Envoy Redhat Openshift Service Mesh 1.0.9

7.5

CVSSv2

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to vi...

Kiali Kiali Redhat Openshift Service Mesh 1.0

7.5

CVSSv2

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions before 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges t...

Kiali Kiali Redhat Openshift Service Mesh 1.0

1 Github repository

4

CVSSv2

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot prior to 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to t...

Istio Istio Redhat Openshift Service Mesh 1.0

NA

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and...

Redhat Openshift Service Mesh 2.0 Redhat Servicemesh-operator 2.0.5.1

5

CVSSv2

CNCF Envoy up to and including 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.

Cncf Envoy Redhat Openshift Service Mesh 1.0 Debian Debian Linux 9.0

10

CVSSv2

A signature verification vulnerability exists in crewjam/saml. This flaw allows an malicious user to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Grafana Grafana Saml Project Saml Redhat Openshift Container Platform 3.11 Redhat Enterprise Linux 8.0 Redhat Openshift Container Platform 4.0 Redhat Openshift Service Mesh 2.0 Fedoraproject Fedora 32 Fedoraproject Fedora 33

Get Started

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook