Skip to content
OpenAdvisories
High RHSA-2021:1540 2 CVEs

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.14 security update

Published Sep 16, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-citadel 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-galley 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-istioctl 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-mixc 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-mixs 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-pilot-agent 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-pilot-discovery 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-proxy 0:1.1.14-1.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-sidecar-injector 0:1.1.14-1.el8

Vulnerabilities 2

  • High 8.1
    CVE-2021-29492 EPSS 63%

    Bypass of path matching rules using escaped slash characters

    Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP URL paths in versions 1.18.2 and before. A remote attacker may craft a path with escaped slashes, e.g. `/something%2F..%2Fadmin`, to bypas…

    envoyproxy envoy
  • Unscored —
    CVE-2021-31920

    Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with mult…

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1951188
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1959481
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1540.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-29492
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-29492
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-29492
  • article
    https://istio.io/latest/news/releases/1.9.x/announcing-1.9.5/
  • report
    https://access.redhat.com/security/cve/CVE-2021-31920
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-31920
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-31920
  • article
    https://istio.io/latest/news/security/istio-security-2021-005/