Description
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | servicemesh-pilot-agent +1 | 1.1.13-3.el8 | RHSA-2021:1322 |
| Red Hat Service Mesh 1 | servicemesh-proxy | 1.1.13-1.el8 | RHSA-2021:1322 |
Advisories 1
- RHSA-2021:1322 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.13 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026