PT-2019-5282 · Istio · Istio

Published 2019-11-11 · Updated 2022-05-24 · CVE-2019-18817

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Istio versions 1.3.x through 1.3.4

Description The issue is related to a denial of service condition that can be triggered by submitting specific input, causing the system to enter an infinite loop. This can allow an attacker to disrupt service. The problem is associated with the continue on listener filters timeout setting being set to True.

Recommendations For Istio versions 1.3.x through 1.3.4, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider setting continue on listener filters timeout to False to prevent the denial of service condition.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2020-02183

CVE-2019-18817

GHSA-VC7H-CMP3-4HW5

Affected Products

Istio

References · 10

• 🔥 https://github.com/istio/istio/issues/18229 · Exploit
• https://osv.dev/vulnerability/CVE-2019-18817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18817 · Security Note
• https://osv.dev/vulnerability/GHSA-vc7h-cmp3-4hw5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02183 · Security Note
• https://istio.io/news/2019/announcing-1.3.5 · Vendor Advisory
• https://github.com/istio/istio · Note
• https://github.com/istio/istio/issues/18229#issuecomment-553190142 · Note
• https://github.com/istio/istio/commit/7570a1f5b56c108aed6ecfa5d2a6048f444bfb37 · Note
• https://istio.io/news/releases/1.3.x/announcing-1.3.5 · Note