GitHub Advisoryadvisory · Go
GHSA-vc7h-cmp3-4hw5 Istio vulnerable to denial of service
HIGH
Official page ↗
- Aliases
- CVE-2019-18817
- Ecosystem
- Go
- Packages
- istio.io/istio
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-835
- Reviewed
- 2023-10-19
Affected packages
• Go istio.io/istio: >= 1.3.0, < 1.3.5 → fixed in 1.3.5
Description
Istio 1.3.x before 1.3.5 is vulnerable to denial of service because `continue_on_listener_filters_timeout` is set to True, a related issue to CVE-2019-18836.
Related
Alias · CVE (1)
- CVE-2019-18817 Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to… vulnerability
Weakness · CWE (1)
- CWE-835 Loop with Unreachable Exit Condition weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-18817 advisory
- https://github.com/istio/istio/issues/18229 web
- https://github.com/istio/istio/issues/18229#issuecomment-553190142 web
- https://github.com/istio/istio/commit/7570a1f5b56c108aed6ecfa5d2a6048f444bfb37 web
- https://github.com/istio/istio package
- https://istio.io/news/2019/announcing-1.3.5 web