PT-2021-22413 · Istio · Istio

Yangminzhu · Published 2021-08-24 · Updated 2022-08-12 · CVE-2021-39156

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Istio versions 1.11.0, 1.10.3 and below, and 1.9.7 and below Istio versions prior to 1.11.1, 1.10.4, and 1.9.8

Description Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. A remotely exploitable issue exists where an HTTP request with #fragment in the path may bypass Istio’s URI path based authorization policies.

Recommendations For Istio versions 1.11.0 and below, update to version 1.11.1 or above. For Istio versions 1.10.3 and below, update to version 1.10.4 or above. For Istio versions 1.9.7 and below, update to version 1.9.8 or above. As a temporary workaround, consider writing a Lua filter to normalize the path.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-706

CWE-863

Related Identifiers

CVE-2021-39156

ECHO-7C50-890F-3B0C

GHSA-HQXW-MM44-GC4R

RHSA-2021:3272

RHSA-2021:3273

Affected Products

Istio

References · 8

• https://istio.io/latest/news/security/istio-security-2021-008 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39156 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39156 · Security Note
• https://osv.dev/vulnerability/GHSA-hqxw-mm44-gc4r · Vendor Advisory
• https://github.com/istio/istio · Note
• https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r · Note
• https://t.me/k8security/381 · Telegram Post
• https://t.me/cibsecurity/27856 · Telegram Post