Skip to content
OpenAdvisories
High ELSA-2021-9525 5 CVEs

Important: olcne security update (Oracle Linux 7)

Published Nov 10, 2021 · Updated Nov 10, 2021

Ecosystem: Oracle Linux

Summary

olcne
[1.2.5-2]
- Update Istio to 1.9.8 to address CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781
- Update proxyv2 image to select iptables legacy or latest based on host operating system
- Turn off Istio PodDisruptionBudget

istio
[1.9.8-3]
- Updated iptables-switch for OL8 and OL7 logic

[1.9.8-2]
- Bump release, addresses the following envoy CVEs,
CVE-2021-32777, CVE-2021-32778, CVE-2021-32779, CVE-2021-32780 & CVE-2021-32781

[1.9.8-1]
- Added Oracle specific files for 1.9.8-1

Fixed packages 11

ReleasePackageFixed in
Oracle Linux · 7 istio 0:1.9.8-3.el8
Oracle Linux · 7 istio-istioctl 0:1.9.8-3.el8
Oracle Linux · 7 istio-pilot-agent 0:1.9.8-3.el8
Oracle Linux · 7 istio-pilot-discovery 0:1.9.8-3.el8
Oracle Linux · 7 olcne-agent 0:1.2.5-2.el8
Oracle Linux · 7 olcne-api-server 0:1.2.5-2.el8
Oracle Linux · 7 olcne-istio-chart 0:1.2.5-2.el8
Oracle Linux · 7 olcne-nginx 0:1.2.5-2.el8
Oracle Linux · 7 olcne-prometheus-chart 0:1.2.5-2.el8
Oracle Linux · 7 olcne-utils 0:1.2.5-2.el8
Oracle Linux · 7 olcnectl 0:1.2.5-2.el8

Vulnerabilities 5

  • High 8.6
    CVE-2021-32777

    Incorrect concatenation of multiple value request headers in ext-authz extension

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value header…

    envoyproxy envoy
  • High 8.6
    CVE-2021-32779

    Incorrectly handling of URI '#fragment' element as part of the path element

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for …

    envoyproxy envoy
  • High 8.6
    CVE-2021-32780

    Incorrect handling of H/2 GOAWAY followed by SETTINGS frames

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy transitions a H/2 connection to the CLOSED state when it receives a GOAWAY frame without any streams outstanding. The c…

    envoyproxy envoy
  • High 8.6
    CVE-2021-32781

    Continued processing of requests after locally generated response

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when loca…

    envoyproxy envoy
  • Medium 5.8
    CVE-2021-32778

    Excessive CPU utilization when closing HTTP/2 streams

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’s procedure for resetting a HTTP/2 stream has O(N^2) complexity, leading to high CPU utilization when a large number of…

    envoyproxy envoy