PT-2022-24864 · Istio+1 · Istio+1

Howardjohn

·

Published

2022-10-13

·

Updated

2022-10-19

·

CVE-2022-39278

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Istio versions prior to 1.15.2 Istio versions prior to 1.14.5 Istio versions prior to 1.13.9
Description Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. The Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker to send a specially crafted or oversized message, which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. The issue is due to an error in regexp.Compile in Go.
Recommendations For versions prior to 1.15.2, upgrade to version 1.15.2 or later. For versions prior to 1.14.5, upgrade to version 1.14.5 or later. For versions prior to 1.13.9, upgrade to version 1.13.9 or later. As a temporary workaround, consider restricting access to the Kubernetes validating or mutating webhook service to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-39278
GHSA-86VR-4WCV-MM9W

Affected Products

Istio
Kubernetes