PT-2019-5282 · Istio · Istio

Publicado 2019-11-11 · Atualizado 2022-05-24 · CVE-2019-18817

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Istio versions 1.3.x through 1.3.4

Description The issue is related to a denial of service condition that can be triggered by submitting specific input, causing the system to enter an infinite loop. This can allow an attacker to disrupt service. The problem is associated with the continue on listener filters timeout setting being set to True.

Recommendations For Istio versions 1.3.x through 1.3.4, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider setting continue on listener filters timeout to False to prevent the denial of service condition.

Exploit

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

BDU:2020-02183

CVE-2019-18817

GHSA-VC7H-CMP3-4HW5

Produtos afetados

Istio

Referências · 10

• 🔥 https://github.com/istio/istio/issues/18229 · Exploit
• https://github.com/istio/istio · Nota
• https://github.com/istio/istio/issues/18229#issuecomment-553190142 · Nota
• https://github.com/istio/istio/commit/7570a1f5b56c108aed6ecfa5d2a6048f444bfb37 · Nota
• https://osv.dev/vulnerability/CVE-2019-18817 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18817 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-vc7h-cmp3-4hw5 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-02183 · Nota de Segurança
• https://istio.io/news/releases/1.3.x/announcing-1.3.5 · Nota
• https://istio.io/news/2019/announcing-1.3.5 · Aviso do Fabricante