Summary
istio
[1.15.7-1]
- Added Oracle specific files for 1.15.7-1
kubernetes
[1.24.8-2]
- libct/cg: add misc controller to v1 drivers (upstream runc patch)
[1.24.8-1]
- Added Oracle specific build files for Kubernetes
olcne
[1.5.12-6]
- Updated the CVE ID's in Istio-1.15.7 changelog entry
[1.5.12-5]
- Bug fix - Append a slash in oci-instance-metada url
[1.5.12-4]
- Update Istio version to 1.15.7 to address CVE's
- CVE-2023-27496
- CVE-2023-27488
- CVE-2023-27493
- CVE-2023-27492
- CVE-2023-27491
- CVE-2023-27487
[1.5.12-3]
- Updated olcne_version argument in olcnectl provision to support <major.minor.patch>
[1.5.12-2]
- Update kubelet for upstream runc misc cgroups patch
[1.5.12-1]
- Fix the bug olcnectl provision fails if ol8_developer does not exist
Fixed packages 17
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | istio | 0:1.15.7-1.el8 |
| Oracle Linux · 8 | istio-istioctl | 0:1.15.7-1.el8 |
| Oracle Linux · 8 | kubeadm | 0:1.24.8-2.el8 |
| Oracle Linux · 8 | kubectl | 0:1.24.8-2.el8 |
| Oracle Linux · 8 | kubelet | 0:1.24.8-2.el8 |
| Oracle Linux · 8 | olcne-agent | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-api-server | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-gluster-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-grafana-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-istio-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-metallb-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-nginx | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-oci-ccm-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-olm-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-prometheus-chart | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcne-utils | 0:1.5.12-6.el8 |
| Oracle Linux · 8 | olcnectl | 0:1.5.12-6.el8 |
Vulnerabilities 6
-
High 8.2
Envoy client may fake the header `x-envoy-original-path`
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the client may bypass JSON Web Token (JWT) checks and forge fake original paths. The header `x-envoy-original-…
-
High 8.1
Envoy doesn't escape HTTP header values
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does not sanitize or escape request properties when generating request headers. This can lead to charact…
-
Medium 6.5
Envoy may crash when a redirect url without a state param is received in the oauth filter
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the OAuth filter assumes that a `state` query param is present on any response that looks like an OAuth redire…
-
Medium 5.4
Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For…
-
Medium 5.4
Envoy forwards invalid Http2/Http3 downstream headers
Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, There is a possibility that non compliant HTTP…
-
Medium 4.8
Envoy may crash when a large request body is processed in Lua filter
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, the Lua filter is vulnerable to denial of service. Attackers can send large request bodies for routes that hav…