PT-2020-12304 · Istio · Istio

Joren Zandstra · Published 2020-06-02 · Updated 2020-06-02 · CVE-2020-10739

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Istio versions 1.4.x through 1.4.8 Istio versions 1.5.x through 1.5.3

Description The issue allows an attacker to trigger a Null Pointer Exception, resulting in a Denial of Service. This can be achieved by sending a specially crafted packet to the ingress gateway or a sidecar. The flaw is present when telemetry v2 is enabled. The servicemesh-proxy is also affected by a null pointer exception flaw.

Recommendations For Istio versions 1.4.x through 1.4.8, update to version 1.4.9 or later. For Istio versions 1.5.x through 1.5.3, update to version 1.5.4 or later. As a temporary workaround, consider disabling telemetry v2 until a patch is available.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2020-10739

RHSA-2020:2148

Affected Products

Istio

References · 6

• https://github.com/istio/envoy/commit/8788a3cf255b647fd14e6b5e2585abaaedb28153#diff-fcf2cf5dd389b5285f882ba4a8708633 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-10739 · Security Note
• https://linux.oracle.com/errata/ELSA-2020-5765.html · Vendor Advisory
• https://istio.io/news/security/istio-security-2020-005 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10739 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10739 · Note