Skip to content
OpenAdvisories
High ELSA-2023-12355 6 CVEs

Important: istio security update (Oracle Linux 7)

Published Jun 2, 2023 · Updated Jun 2, 2023

Ecosystem: Oracle Linux

Summary

istio
[1.16.4-1]
- Added Oracle specific files for 1.16.4-1

kubernetes
[1.25.7-2]
- libct/cg: add misc controller to v1 drivers (upstream runc patch)

olcne
[1.6.1-9]
- Updated the CVE ID's in Istio-1.16.4 changelog entry

[1.6.1-8]
- Update Istio config to include 1.15.7 to support upgrade from 1.5.x to 1.6.x

[1.6.1-7]
- Bugfix:Append a slash in oci-instance-metada query url

[1.6.1-6]
- Fixed helm installation in OLCNE upgrade

[1.6.1-5]
- Deprecate oci-private-key <path-on-control-plane-nodes> in favour of oci-private-key-file <path-on-operatpr-node>
- Updated olcne_version argument in olcnectl provision to support <major.minor.patch>

[1.6.1-4]
- Update Istio version to 1.16.4 to address CVE's
- CVE-2023-27496
- CVE-2023-27488
- CVE-2023-27493
- CVE-2023-27492
- CVE-2023-27491
- CVE-2023-27487

[1.6.1-3]
- Resolved the issue to install multiple network cards using multus

[1.6.1-2]
- Update kubelet for upstream runc misc cgroups patch

[1.6.1-1]
- Fix the bug olcnectl provision fails if ol8_developer does not exist

Fixed packages 19

ReleasePackageFixed in
Oracle Linux · 7 istio 0:1.16.4-1.el7
Oracle Linux · 7 istio-istioctl 0:1.16.4-1.el7
Oracle Linux · 7 kubeadm 0:1.25.7-2.el7
Oracle Linux · 7 kubectl 0:1.25.7-2.el7
Oracle Linux · 7 kubelet 0:1.25.7-2.el7
Oracle Linux · 7 olcne-agent 0:1.6.1-9.el7
Oracle Linux · 7 olcne-api-server 0:1.6.1-9.el7
Oracle Linux · 7 olcne-calico-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-gluster-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-grafana-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-istio-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-metallb-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-multus-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-nginx 0:1.6.1-9.el7
Oracle Linux · 7 olcne-oci-ccm-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-olm-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-prometheus-chart 0:1.6.1-9.el7
Oracle Linux · 7 olcne-utils 0:1.6.1-9.el7
Oracle Linux · 7 olcnectl 0:1.6.1-9.el7

Vulnerabilities 6

  • High 8.2
    CVE-2023-27487

    Envoy client may fake the header `x-envoy-original-path`

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-…

    envoyproxy envoy
  • High 8.1
    CVE-2023-27493

    Envoy doesn't escape HTTP header values

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to charact…

    envoyproxy envoy
  • Medium 6.5
    CVE-2023-27496

    Envoy may crash when a redirect url without a state param is received in the oauth filter

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redire…

    envoyproxy envoy
  • Medium 5.4
    CVE-2023-27488

    Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For…

    envoyproxy envoy
  • Medium 5.4
    CVE-2023-27491

    Envoy forwards invalid Http2/Http3 downstream headers

    Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP…

    envoyproxy envoy
  • Medium 4.8
    CVE-2023-27492

    Envoy may crash when a large request body is processed in Lua filter

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that hav…

    envoyproxy envoy