Skip to content
OpenAdvisories
High ELSA-2023-12781 4 CVEs

Important: istio security update (Oracle Linux 7)

Published Sep 8, 2023 · Updated Sep 8, 2023

Ecosystem: Oracle Linux

Summary

istio
[1.16.7-1]
- Addresses CVE CVE-2023-35941, CVE-2023-35942, CVE-2023-35943, CVE-2023-35944.

olcne
[1.6.3-1]
- Add Istio-1.16.7 to address CVE's
- CVE-2023-35941
- CVE-2023-35942
- CVE-2023-35943
- CVE-2023-35944

Fixed packages 16

ReleasePackageFixed in
Oracle Linux · 7 istio 0:1.16.7-1.el7
Oracle Linux · 7 istio-istioctl 0:1.16.7-1.el7
Oracle Linux · 7 olcne-agent 0:1.6.3-1.el7
Oracle Linux · 7 olcne-api-server 0:1.6.3-1.el7
Oracle Linux · 7 olcne-calico-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-gluster-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-grafana-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-istio-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-metallb-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-multus-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-nginx 0:1.6.3-1.el7
Oracle Linux · 7 olcne-oci-ccm-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-olm-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-prometheus-chart 0:1.6.3-1.el7
Oracle Linux · 7 olcne-utils 0:1.6.3-1.el7
Oracle Linux · 7 olcnectl 0:1.6.3-1.el7

Vulnerabilities 4

  • High 8.6
    CVE-2023-35941

    Envoy vulnerable to OAuth2 credentials exploit with permanent validity

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, a malicious client is able to construct credentials with permanent validity in some specific scenarios. This…

    envoyproxy envoy
  • High 8.2
    CVE-2023-35944

    Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes

    Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme checks are case-sensitive. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, this can…

    envoyproxy envoy
  • Medium 6.5
    CVE-2023-35942

    Envoy's gRPC access log crash caused by the listener draining

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, gRPC access loggers using listener's global scope can cause a `use-after-free` crash when the listener is dr…

    envoyproxy envoy
  • Medium 6.3
    CVE-2023-35943

    Envoy vulnerable to CORS filter segfault when origin header is removed

    Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.27.0, 1.26.4, 1.25.9, 1.24.10, and 1.23.12, the CORS filter will segfault and crash Envoy when the `origin` header is removed and deleted between `decod…

    envoyproxy envoy