GitHub Advisoryadvisory · Go

GHSA-xwx5-5c9g-x68x Ill-formed headers may lead to unexpected behavior in Istio

MEDIUM Published 2022-06-10 Modified 2022-06-10 Official page ↗
Aliases
CVE-2022-31045
Ecosystem
Go
Packages
istio.io/istio
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Reviewed
2022-06-10

Affected packages

• Go istio.io/istio: < 1.12.18 → fixed in 1.12.18 • Go istio.io/istio: >= 1.13.0, < 1.13.5 → fixed in 1.13.5 • Go istio.io/istio: >= 1.14.0, < 1.14.1 → fixed in 1.14.1

Description

Impact Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. You are at most risk if you have an Istio ingress Gateway exposed to external traffic. Patches 1.12.8, 1.13.5, 1.14.1 Workarounds No. References More details can be found in the Istio Security Bulletin For more information If you have any questions or comments about this advisory, please email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-31045 Istio is an open platform to connect, manage, and secure microservices. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References