GitHub Advisoryadvisory · Go

GHSA-qcvw-82hh-gq38 Istio ReDoS Vulnerability

HIGH Published 2022-05-24 Modified 2023-07-17 Official page ↗
Aliases
CVE-2019-14993
Ecosystem
Go
Packages
istio.io/istio
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-185
Reviewed
2023-07-17

Affected packages

• Go istio.io/istio: < 1.1.13 → fixed in 1.1.13 • Go istio.io/istio: >= 1.2.0, < 1.2.4 → fixed in 1.2.4

Description

Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.

Related

Alias · CVE (1)

  • CVE-2019-14993 Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the… vulnerability

Weakness · CWE (1)

  • CWE-185 Incorrect Regular Expression weakness

References