Skip to content
OpenAdvisories
Unscored RHSA-2019:4222 3 CVEs

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.3 RPMs security update

Published Sep 16, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · Service Mesh 1 service_mesh:1.0::el7 kiali 0:v1.0.8.redhat1-1.el7
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-citadel 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-cni 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-galley 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-grafana 0:6.2.2-25.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-grafana-prometheus 0:6.2.2-25.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-istioctl 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-mixc 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-mixs 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-operator 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-pilot-agent 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-pilot-discovery 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-prometheus 0:2.7.2-26.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-proxy 0:1.0.3-1.el8
Red Hat · Service Mesh 1 service_mesh:1.0::el8 servicemesh-sidecar-injector 0:1.0.3-1.el8

Vulnerabilities 3

  • Unscored —
    CVE-2019-18801

    An issue was discovered in Envoy 1.12.0. An untrusted remote client may send HTTP/2 requests that write to the heap out…

  • Unscored —
    CVE-2019-18802

    An issue was discovered in Envoy 1.12.0. An untrusted remote client may send an HTTP header (such as Host) with whitesp…

  • Unscored —
    CVE-2019-18838

    An issue was discovered in Envoy 1.12.0. Upon receipt of a malformed HTTP request without a Host header, it sends an in…

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1773444
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1773447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1773449
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4222.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-18801
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-18801
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-18801
  • article
    https://github.com/envoyproxy/envoy/security/advisories/GHSA-gxvv-x4p2-rppp
  • article
    https://groups.google.com/forum/#!topic/envoy-users/m7z5fGkCzPI
  • report
    https://access.redhat.com/security/cve/CVE-2019-18802
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-18802
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-18802
  • article
    https://github.com/envoyproxy/envoy/security/advisories/GHSA-356m-vhw2-wcm4
  • report
    https://access.redhat.com/security/cve/CVE-2019-18838
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-18838
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-18838
  • article
    https://github.com/envoyproxy/envoy/security/advisories/GHSA-f2rv-4w6x-rwhc