Skip to content
OpenAdvisories
High RHSA-2021:3273 5 CVEs

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.17.1 security update

Published Sep 16, 2024 · Updated Mar 18, 2026

Ecosystem: Red Hat

Fixed packages 10

ReleasePackageFixed in
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-citadel 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-galley 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-istioctl 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-mixc 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-mixs 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-pilot-agent 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-pilot-discovery 0:1.1.17-3.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-proxy 0:1.1.17-2.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-sidecar-injector 0:1.1.17-3.el8

Vulnerabilities 5

  • High 8.6
    CVE-2021-32777

    Incorrect concatenation of multiple value request headers in ext-authz extension

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when ext-authz extension is sending request headers to the external authorization service it must merge multiple value header…

    envoyproxy envoy
  • High 8.6
    CVE-2021-32779

    Incorrectly handling of URI '#fragment' element as part of the path element

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy incorrectly handled a URI '#fragment' element as part of the path element. Envoy is configured with an RBAC filter for …

    envoyproxy envoy
  • High 8.6
    CVE-2021-32781

    Continued processing of requests after locally generated response

    Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after Envoy sends a locally generated response it must stop further processing of request or response data. However when loca…

    envoyproxy envoy
  • High 8.3
    CVE-2021-39155

    Authorization Policy Bypass Due to Case Insensitive Host Comparison

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio aut…

    istio istio istio.io/istio Go
  • High 8.1
    CVE-2021-39156 Public exploit

    Fragments in Path May Lead to Authorization Policy Bypass

    Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitabl…

    istio istio istio.io/istio Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1996915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1996929
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1996933
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1996934
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1996935
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3273.json
  • report
    https://access.redhat.com/security/cve/CVE-2021-32777
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-32777
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-32777
  • article
    https://istio.io/latest/news/security/istio-security-2021-008/
  • report
    https://access.redhat.com/security/cve/CVE-2021-32779
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-32779
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-32779
  • report
    https://access.redhat.com/security/cve/CVE-2021-32781
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-32781
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-32781
  • report
    https://access.redhat.com/security/cve/CVE-2021-39155
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-39155
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-39155
  • report
    https://access.redhat.com/security/cve/CVE-2021-39156
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-39156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-39156