PT-2022-24947 · Istio · Istio

Howardjohn · Published 2022-11-09 · Updated 2022-11-15 · CVE-2022-39388

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Istio versions 1.15.x prior to 1.15.3

Description A user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane.

Recommendations For versions prior to 1.15.3, upgrade to version 1.15.3 or later to resolve the issue. As a temporary workaround, consider restricting localhost access to the Istiod control plane until a patch is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-39388

GHSA-6C6P-H79F-G6P4

Affected Products

Istio

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39388.json · Exploit
• https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32 · Patch
• https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9 · Patch
• https://osv.dev/vulnerability/GHSA-6c6p-h79f-g6p4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39388 · Security Note
• https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3 · Vendor Advisory
• https://github.com/istio/istio · Note
• https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4 · Note
• https://t.me/cvenotify/37801 · Telegram Post
• https://t.me/cibsecurity/52916 · Telegram Post