PT-2022-15031 · Istio · Istio

Aakash2017 + 1 · Published 2022-01-19 · Updated 2022-01-27 · CVE-2022-21679

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Istio versions 1.12.0 through 1.12.1

Description The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. This issue occurs due to a bug in the 1.12.0 and 1.12.1 versions that incorrectly uses the new Envoy API with the 1.11 data plane, causing the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane.

Recommendations To resolve the issue, users are advised to upgrade to a version that does not have this bug. For versions 1.12.0 and 1.12.1, do not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2022-21679

GHSA-RWFR-XRVW-2RVV

Affected Products

Istio

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21679.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-21679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21679 · Security Note
• https://istio.io/latest/news/releases/1.12.x/announcing-1.12.2 · Vendor Advisory
• https://github.com/istio/istio/security/advisories/GHSA-rwfr-xrvw-2rvv · Note
• https://t.me/cibsecurity/35905 · Telegram Post