GitHub Advisoryadvisory · Go

GHSA-6c6p-h79f-g6p4 Istio may allow identity impersonation if user has localhost access

HIGH Published 2022-11-09 Modified 2022-11-09 Official page ↗
Aliases
CVE-2022-39388
Ecosystem
Go
Packages
github.com/istio/istio
Severity
High
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-863
Reviewed
2022-11-09

Affected packages

• Go github.com/istio/istio: >= 1.15.0-beta.0, < 1.15.3 → fixed in 1.15.3

Description

Impact User can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Patches 1.15.3 Workarounds No. If using 1.15.2 please upgrade to 1.15.3 or later. References None at this time. For more information If you have any questions or comments about this advisory, please email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-39388 Istio is an open platform to connect, manage, and secure microservices. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References