PT-2022-20483 · Envoy+1 · Envoy+1

Howardjohn · Published 2022-06-09 · Updated 2022-06-17 · CVE-2022-31045

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.12.8 Istio versions prior to 1.13.5 Istio versions prior to 1.14.1

Description The issue arises from ill-formed headers sent to Envoy in certain configurations, leading to unexpected memory access, which can result in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic.

Recommendations For versions prior to 1.12.8, upgrade to version 1.12.8 or later. For versions prior to 1.13.5, upgrade to version 1.13.5 or later. For versions prior to 1.14.1, upgrade to version 1.14.1 or later. As a temporary workaround, consider restricting access to the Istio ingress Gateway to minimize the risk of exploitation.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2022-31045

ECHO-4846-7CB3-2D3C

GHSA-XWX5-5C9G-X68X

RHSA-2022:5004

Affected Products

Envoy

Istio

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31045.json · Exploit
• https://linux.oracle.com/errata/ELSA-2022-9587.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31045 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9586.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9589.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9774.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xwx5-5c9g-x68x · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9588.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9773.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31045 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-9772.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9771.html · Vendor Advisory
• https://github.com/istio/istio · Note
• https://github.com/istio/istio/security/advisories/GHSA-xwx5-5c9g-x68x · Note
• https://istio.io/latest/news/security/istio-security-2022-05 · Note