Skip to content
OpenAdvisories
High RHSA-2022:1276 16 CVEs

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update

Published Sep 30, 2024 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 9

ReleasePackageFixed in
Red Hat · Service Mesh 2 service_mesh:2.0::el8 kiali 0:v1.24.7.redhat1-1.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh 0:2.0.9-3.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-istioctl 0:2.0.9-3.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-mixc 0:2.0.9-3.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-mixs 0:2.0.9-3.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-pilot-agent 0:2.0.9-3.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-pilot-discovery 0:2.0.9-3.el8
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-prometheus 0:2.14.0-16.el8.1
Red Hat · Service Mesh 2 service_mesh:2.0::el8 servicemesh-proxy 0:2.0.9-3.el8

Vulnerabilities 16

  • High 8.6
    CVE-2021-3121

    Improper Input Validation in GoGo Protobuf

    An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

    k3d k3d-proxy k3d-tools ctop Debian Ubuntu Alpine Wolfi Go
  • High 7.5
    CVE-2021-29482

    denial of service in github.com/ulikunitz/xz

    xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a…

    ulikunitz xz github.com/ulikunitz/xz golang-github-ulikunitz-xz Debian Ubuntu Go
  • High 7.5
    CVE-2021-3749 Public exploit

    Inefficient Regular Expression Complexity in axios/axios

    axios is vulnerable to Inefficient Regular Expression Complexity

    axios axios/axios node-axios axios Debian Ubuntu npm
  • High 7.5
    CVE-2021-43565

    x/crypto/ssh vulnerable to panic via malformed packets

    The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

    k3d k3d-proxy k3d-tools cri-o Debian Ubuntu Azure Linux Wolfi Go
  • High 7.5
    CVE-2021-43824

    Null pointer dereference in envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vec…

    envoyproxy envoy
  • High 7.5
    CVE-2021-43826

    Crash when tunneling TCP over HTTP in Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_co…

    envoyproxy envoy
  • High 7.5
    CVE-2022-21655

    Incorrect handling of internal redirects results in crash in Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service.…

    envoyproxy envoy
  • High 7.5
    CVE-2022-23635

    Unauthenticated control plane denial of service attack in Istio

    Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in …

    istio istio istio.io/istio Go
  • High 7.5
    CVE-2022-24726

    Unauthenticated control plane denial of service attack in Istio

    Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in th…

    istio istio
  • High 7.4
    CVE-2022-21654

    Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tl…

    envoyproxy envoy
  • Medium 6.1
    CVE-2021-43825

    Use-after-free in Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the…

    envoyproxy envoy
  • Medium 4.4
    CVE-2022-23606

    Crash when a cluster is deleted in Envoy

    Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in…

    envoyproxy envoy
  • Unscored —
    CVE-2020-28851

    In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…

    buildah google-guest-agent multus golang-golang-x-text Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2020-28852

    In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while process…

    buildah google-guest-agent multus golang-golang-x-text Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-29923

    Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in…

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2021-36221

    Panic in ReverseProxy in net/http/httputil

    Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

    go stdlib golang-1.8 golang-1.13 Debian Ubuntu Alpine Go

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1913333
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1913338
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1921650
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1954368
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1992006
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1995656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1999784
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2030787
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050744
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050746
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050748
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050753
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2050758
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2057277
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2061638
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1276.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-28851
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-28851
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-28851
  • report
    https://access.redhat.com/security/cve/CVE-2020-28852
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-28852
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-28852
  • report
    https://access.redhat.com/security/cve/CVE-2021-3121
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3121
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3121
  • report
    https://access.redhat.com/security/cve/CVE-2021-3749
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-3749
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-3749
  • article
    https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929
  • article
    https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31
  • report
    https://access.redhat.com/security/cve/CVE-2021-29482
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-29482
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-29482
  • report
    https://access.redhat.com/security/cve/CVE-2021-29923
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2021-29923
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2021-29923
  • article
    https://sick.codes/sick-2021-016/