Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2020-1762

kiali: ignoring JWT claim fields

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

CVSS 3.1 · 7 High EPSS 1.2% KEV · Not listed
Vendors
Kiali Redhat
Products
Kiali Openshift Service Mesh Service Mesh
CVE-2020-1704

openshift-service-mesh/kiali-rhel7-operator: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Service Mesh Service Mesh
CVE-2019-9900

istio/envoy: Authorization bypass via null characters injection in HTTP/1.x

When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting header values containing embedded NUL characters to potentially bypass header matching rules, gaining access to unauthorized resources.

CVSS 3.1 · 8.3 High EPSS 3.7% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Openshift Service Mesh Service Mesh
CVE-2019-25014

istio-pilot: requests to debug api can result in panic

A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application).

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Openshift Service Mesh Service Mesh