Action not permitted
Modal body text goes here.
CVE-2023-27488
Vulnerability from cvelistv5
Published
2023-04-04 17:57
Modified
2024-08-02 12:09
Severity ?
EPSS score ?
Summary
Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.
References
▼ | URL | Tags | |
---|---|---|---|
security-advisories@github.com | https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph | Exploit, Mitigation, Vendor Advisory |
Impacted products
▼ | Vendor | Product |
---|---|---|
envoyproxy | envoy |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T12:09:43.514Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph", "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "envoy", "vendor": "envoyproxy", "versions": [ { "status": "affected", "version": "\u003e= 1.25.0, \u003c1.25.3" }, { "status": "affected", "version": "\u003e= 1.24.0, \u003c 1.24.4" }, { "status": "affected", "version": "\u003e= 1.23.0, \u003c 1.23.6" }, { "status": "affected", "version": "\u003c 1.22.9" } ] } ], "descriptions": [ { "lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service.\n\nWhen Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. \n\nAs of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-04-04T17:57:17.379Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph", "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph" } ], "source": { "advisory": "GHSA-9g5w-hqr3-w2ph", "discovery": "UNKNOWN" }, "title": "Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received." } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2023-27488", "datePublished": "2023-04-04T17:57:17.379Z", "dateReserved": "2023-03-01T19:03:56.634Z", "dateUpdated": "2024-08-02T12:09:43.514Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-27488\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2023-04-04T18:15:07.083\",\"lastModified\":\"2023-11-07T04:09:57.593\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service.\\n\\nWhen Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. \\n\\nAs of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":2.5}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.22.9\",\"matchCriteriaId\":\"DAD93214-C958-4A69-9291-15D1C22CFD3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.23.0\",\"versionEndExcluding\":\"1.23.6\",\"matchCriteriaId\":\"17BFB303-DA5A-4E83-93F7-3C1EA340E434\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.24.0\",\"versionEndExcluding\":\"1.24.4\",\"matchCriteriaId\":\"92B633B8-FA4A-4630-9302-96F2C8336E36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.25.0\",\"versionEndExcluding\":\"1.25.3\",\"matchCriteriaId\":\"8AFC6741-6FDF-47F6-A4AF-B5F5233ABB71\"}]}]}],\"references\":[{\"url\":\"https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}" } }
rhsa-2023_4623
Vulnerability from csaf_redhat
Published
2023-08-11 16:46
Modified
2024-11-06 03:31
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update
Notes
Topic
Red Hat OpenShift Service Mesh 2.2.9
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.
Security Fix(es):
* envoy: Client may fake the header `x-envoy-original-path` (CVE-2023-27487)
* envoy: envoy doesn't escape HTTP header values (CVE-2023-27493)
* envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received (CVE-2023-27488)
* envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream (CVE-2023-27491)
* envoy: Crash when a large request body is processed in Lua filter (CVE-2023-27492)
* envoy: Crash when a redirect url without a state param is received in the oauth filter (CVE-2023-27496)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Service Mesh 2.2.9\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* envoy: Client may fake the header `x-envoy-original-path` (CVE-2023-27487)\n\n* envoy: envoy doesn\u0027t escape HTTP header values (CVE-2023-27493)\n\n* envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received (CVE-2023-27488)\n\n* envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream (CVE-2023-27491)\n\n* envoy: Crash when a large request body is processed in Lua filter (CVE-2023-27492)\n\n* envoy: Crash when a redirect url without a state param is received in the oauth filter (CVE-2023-27496)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:4623", "url": "https://access.redhat.com/errata/RHSA-2023:4623" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "2179135", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179135" }, { "category": "external", "summary": "2179138", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179138" }, { "category": "external", "summary": "2179139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179139" }, { "category": "external", "summary": "2182155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182155" }, { "category": "external", "summary": "2182156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182156" }, { "category": "external", "summary": "2182158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182158" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4623.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.2.9 security update", "tracking": { "current_release_date": "2024-11-06T03:31:51+00:00", "generator": { "date": "2024-11-06T03:31:51+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2023:4623", "initial_release_date": "2023-08-11T16:46:48+00:00", "revision_history": [ { "date": "2023-08-11T16:46:48+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-08-11T16:46:48+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T03:31:51+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHOSSM 2.2 for RHEL 8", "product": { "name": "RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:2.2::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "product": { "name": "openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "product_id": "openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "product_identification_helper": { "purl": "pkg:oci/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "product": { "name": "openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "product_id": "openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "product_identification_helper": { "purl": "pkg:oci/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/grafana-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "product": { "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "product_id": "openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "product_identification_helper": { "purl": "pkg:oci/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel8\u0026tag=2.2.9-2" } } }, { "category": "product_version", "name": "openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "product": { "name": "openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "product_id": "openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "product_identification_helper": { "purl": "pkg:oci/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/pilot-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "product": { "name": "openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "product_id": "openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "product_identification_helper": { "purl": "pkg:oci/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/prometheus-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "product": { "name": "openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "product_id": "openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "product_identification_helper": { "purl": "pkg:oci/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/proxyv2-rhel8\u0026tag=2.2.9-2" } } }, { "category": "product_version", "name": "openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "product": { "name": "openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "product_id": "openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "product_identification_helper": { "purl": "pkg:oci/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61?arch=s390x\u0026repository_url=registry.redhat.io/openshift-service-mesh/ratelimit-rhel8\u0026tag=2.2.9-1" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "product": { "name": "openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "product_id": "openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "product_identification_helper": { "purl": "pkg:oci/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "product": { "name": "openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "product_id": "openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "product_identification_helper": { "purl": "pkg:oci/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/grafana-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "product": { "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "product_id": "openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "product_identification_helper": { "purl": "pkg:oci/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel8\u0026tag=2.2.9-2" } } }, { "category": "product_version", "name": "openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "product": { "name": "openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "product_id": "openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/pilot-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "product": { "name": "openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "product_id": "openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "product_identification_helper": { "purl": "pkg:oci/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/prometheus-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "product": { "name": "openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "product_id": "openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "product_identification_helper": { "purl": "pkg:oci/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/proxyv2-rhel8\u0026tag=2.2.9-2" } } }, { "category": "product_version", "name": "openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "product": { "name": "openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "product_id": "openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "product_identification_helper": { "purl": "pkg:oci/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-service-mesh/ratelimit-rhel8\u0026tag=2.2.9-1" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "product": { "name": "openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "product_id": "openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "product_identification_helper": { "purl": "pkg:oci/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-cni-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "product": { "name": "openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "product_id": "openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "product_identification_helper": { "purl": "pkg:oci/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/grafana-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "product": { "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "product_id": "openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "product_identification_helper": { "purl": "pkg:oci/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/istio-must-gather-rhel8\u0026tag=2.2.9-2" } } }, { "category": "product_version", "name": "openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "product": { "name": "openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "product_id": "openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "product_identification_helper": { "purl": "pkg:oci/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/pilot-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "product": { "name": "openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "product_id": "openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "product_identification_helper": { "purl": "pkg:oci/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/prometheus-rhel8\u0026tag=2.2.9-1" } } }, { "category": "product_version", "name": "openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64", "product": { "name": "openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64", "product_id": "openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64", "product_identification_helper": { "purl": "pkg:oci/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/proxyv2-rhel8\u0026tag=2.2.9-2" } } }, { "category": "product_version", "name": "openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64", "product": { "name": "openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64", "product_id": "openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64", "product_identification_helper": { "purl": "pkg:oci/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-service-mesh/ratelimit-rhel8\u0026tag=2.2.9-1" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64" }, "product_reference": "openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x" }, "product_reference": "openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le" }, "product_reference": "openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x" }, "product_reference": "openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64" }, "product_reference": "openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le" }, "product_reference": "openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x" }, "product_reference": "openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64" }, "product_reference": "openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le" }, "product_reference": "openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x" }, "product_reference": "openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64" }, "product_reference": "openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le" }, "product_reference": "openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le" }, "product_reference": "openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x" }, "product_reference": "openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64" }, "product_reference": "openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le" }, "product_reference": "openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x" }, "product_reference": "openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" }, "product_reference": "openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le" }, "product_reference": "openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x" }, "product_reference": "openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "relates_to_product_reference": "8Base-RHOSSM-2.2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64 as a component of RHOSSM 2.2 for RHEL 8", "product_id": "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" }, "product_reference": "openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64", "relates_to_product_reference": "8Base-RHOSSM-2.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-27487", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2179135" } ], "notes": [ { "category": "description", "text": "A flaw was found in envoy. The header x-envoy-original-path should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header could then be used for trace logs and grpc logs, used in the URL for jwt_authn checks if the jwt_authn filter is used, and any other upstream use of the x-envoy-original-path header.", "title": "Vulnerability description" }, { "category": "summary", "text": "envoy: Client may fake the header `x-envoy-original-path`", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "known_not_affected": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-27487" }, { "category": "external", "summary": "RHBZ#2179135", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179135" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-27487", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27487" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-27487", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27487" } ], "release_date": "2023-04-04T19:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-08-11T16:46:48+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "envoy: Client may fake the header `x-envoy-original-path`" }, { "cve": "CVE-2023-27488", "discovery_date": "2023-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182156" } ], "notes": [ { "category": "description", "text": "A flaw was found in Envoy which could allow an attacker to bypass authentication checks when ext_authz is used by crafting a malicious http header with a non-UTF8 value.", "title": "Vulnerability description" }, { "category": "summary", "text": "envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "known_not_affected": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-27488" }, { "category": "external", "summary": "RHBZ#2182156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182156" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-27488", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27488" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-27488", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27488" }, { "category": "external", "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph", "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph" } ], "release_date": "2023-04-04T19:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-08-11T16:46:48+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1" }, "products": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "envoy: gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received" }, { "cve": "CVE-2023-27491", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2023-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2179138" } ], "notes": [ { "category": "description", "text": "A flaw was found in Envoy that may allow attackers to send specially crafted HTTP/2 or HTTP/3 requests to trigger parsing errors on the upstream HTTP/1 service.", "title": "Vulnerability description" }, { "category": "summary", "text": "envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "known_not_affected": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-27491" }, { "category": "external", "summary": "RHBZ#2179138", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179138" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-27491", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27491" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-27491", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27491" }, { "category": "external", "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp", "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5jmv-cw9p-f9rp" } ], "release_date": "2023-04-04T19:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-08-11T16:46:48+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "envoy: Envoy forwards invalid HTTP/2 and HTTP/3 downstream" }, { "cve": "CVE-2023-27492", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2023-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2179139" } ], "notes": [ { "category": "description", "text": "A flaw was found in Envoy. This issue may allow attackers to send large request bodies for routes that have the Lua filter enabled, which will trigger a crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "envoy: Crash when a large request body is processed in Lua filter", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "known_not_affected": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-27492" }, { "category": "external", "summary": "RHBZ#2179139", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179139" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-27492", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27492" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-27492", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27492" } ], "release_date": "2023-04-04T19:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-08-11T16:46:48+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "envoy: Crash when a large request body is processed in Lua filter" }, { "cve": "CVE-2023-27493", "discovery_date": "2023-03-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182158" } ], "notes": [ { "category": "description", "text": "A flaw was found in Envoy. Envoy doesn\u0027t escape HTTP header values due to a specifically constructed HTTP request or mTLS connection with a specifically crafted client certificate. Envoy configuration must also include an option to add request headers that were generated using inputs from the request, for example, the peer certificate SAN.", "title": "Vulnerability description" }, { "category": "summary", "text": "envoy: envoy doesn\u0027t escape HTTP header values", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "known_not_affected": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-27493" }, { "category": "external", "summary": "RHBZ#2182158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182158" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-27493", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27493" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-27493", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27493" } ], "release_date": "2023-04-04T19:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-08-11T16:46:48+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "envoy: envoy doesn\u0027t escape HTTP header values" }, { "cve": "CVE-2023-27496", "discovery_date": "2023-03-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2182155" } ], "notes": [ { "category": "description", "text": "A flaw was found in Envoy. If Envoy is running with the OAuth filter enabled, a malicious actor could construct a request which would cause denial of service, crashing Envoy.", "title": "Vulnerability description" }, { "category": "summary", "text": "envoy: Crash when a redirect url without a state param is received in the oauth filter", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "known_not_affected": [ "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:1894163c4006a3c8e18cff16f1f8eaea524ab70baa657b4e5f248c6a5ba91353_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:492ab85f14b73f01e03521d6b3aab76a673d31c0032d4a63ae30aed0e1cf1ed8_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/grafana-rhel8@sha256:c0c950e26be89b52508a2bf8fdf7df8efd18e58bba2c7ad35940c41cda4176fd_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:72792895a400d9e28f4e12737fc5eadd2d20943026c4c536cbd6508fc823f6a7_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:9820a5e2d80f2c9c69f4d829b63c78bcbfa75ab7b42d7722e13e76db9bd1ecda_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-cni-rhel8@sha256:a0fffc8c8255ebe52475124f72048d54109a92c7f9e1f4256d17c35204b846d9_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:0290aac66c0f89c9faf6c29fee940f8ec3f3c9a0e126307837f9b1cd37efe8c0_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:41bc79c9b2c3af157198b3ba094eea971d8b1f29707ccd40ae4b95e8ecd7774f_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/istio-must-gather-rhel8@sha256:559ed9613b1ee4717890325c1fd05961756a45a9acd08e8036d2db6780b5dd8d_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:1fac42f4073e9a296a0c16012c41a61f5a6ee0df8500515fbd33a694d29503e2_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:357d027eb44c202d715f53a04246462ce3501646481577164b3735641d707e28_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/pilot-rhel8@sha256:51313956891391c4b756365ec2078c13ec9b72d6097d2907361808d478a6fb4c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5b872c6fe3c03528b9ca4bc9c56d5346b695c923f82f477b4574f604fa8f3673_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:5da99f12e7e9ac6562f5480138366a11ed56e81af5bf2956b767357b3fd73e9f_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/prometheus-rhel8@sha256:efbb8d27ec4cbd31194f00e47e4c8882651d41ea18eb544d6fae016a2395f8ea_amd64", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:2deec3e58640d06553b6fa82efe9e3939d3ae76f99020a9e4840a4a0cc65c091_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:58965678412910c9af83afe9f44efd37d8c99927def07fd429baa25b00919b61_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/ratelimit-rhel8@sha256:66e212367c731d5e7d270778580658e86225a628dcc610a827517c8f18db352a_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-27496" }, { "category": "external", "summary": "RHBZ#2182155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2182155" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-27496", "url": "https://www.cve.org/CVERecord?id=CVE-2023-27496" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-27496", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27496" } ], "release_date": "2023-04-04T19:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-08-11T16:46:48+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:29246b072bb2829c8e86b41e7ecdf8e3845d64b9f87247cf81a6088a3d040d3c_ppc64le", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:60036f920ef18e80ed97dadb25e4d6ae2e63f74e04c51e18badf22aae25a7f50_s390x", "8Base-RHOSSM-2.2:openshift-service-mesh/proxyv2-rhel8@sha256:d8a8d11de42f5105b47b89bf715945825fa496d05aa1fcbcbd230bad2d31d59f_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "envoy: Crash when a redirect url without a state param is received in the oauth filter" } ] }
wid-sec-w-2023-2058
Vulnerability from csaf_certbund
Published
2023-08-13 22:00
Modified
2023-10-08 22:00
Summary
Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.\r\nRed Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-2058 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2058.json" }, { "category": "self", "summary": "WID-SEC-2023-2058 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2058" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:3997-1 vom 2023-10-06", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-October/016564.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALASECS-2023-007 vom 2023-09-27", "url": "https://alas.aws.amazon.com/AL2/ALASECS-2023-007.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5175 vom 2023-09-14", "url": "https://access.redhat.com/errata/RHSA-2023:5175" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:5174 vom 2023-09-14", "url": "https://access.redhat.com/errata/RHSA-2023:5174" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-12772 vom 2023-09-11", "url": "https://linux.oracle.com/errata/ELSA-2023-12772.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-12781 vom 2023-09-08", "url": "https://linux.oracle.com/errata/ELSA-2023-12781.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-12780 vom 2023-09-08", "url": "https://linux.oracle.com/errata/ELSA-2023-12780.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2023-12771 vom 2023-09-06", "url": "https://linux.oracle.com/errata/ELSA-2023-12771.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS2ECS-2023-006 vom 2023-09-07", "url": "https://alas.aws.amazon.com/AL2/ALASECS-2023-006.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4627 vom 2023-08-13", "url": "https://access.redhat.com/errata/RHSA-2023:4627" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4625 vom 2023-08-13", "url": "https://access.redhat.com/errata/RHSA-2023:4625" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4624 vom 2023-08-13", "url": "https://access.redhat.com/errata/RHSA-2023:4624" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:4623 vom 2023-08-13", "url": "https://access.redhat.com/errata/RHSA-2023:4623" } ], "source_lang": "en-US", "title": "Red Hat OpenShift Service Mesh und Service Mesh Containers: Mehrere Schwachstellen", "tracking": { "current_release_date": "2023-10-08T22:00:00.000+00:00", "generator": { "date": "2024-02-15T17:40:28.297+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-2058", "initial_release_date": "2023-08-13T22:00:00.000+00:00", "revision_history": [ { "date": "2023-08-13T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-09-06T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Amazon und Oracle Linux aufgenommen" }, { "date": "2023-09-10T22:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-09-11T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2023-09-14T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2023-09-27T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2023-10-08T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von SUSE aufgenommen" } ], "status": "final", "version": "7" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux \u003c Migration Toolkit for Applications 6.2.0", "product": { "name": "Red Hat Enterprise Linux \u003c Migration Toolkit for Applications 6.2.0", "product_id": "T029302", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:migration_toolkit_for_applications_6.2.0" } } } ], "category": "product_name", "name": "Enterprise Linux" }, { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift \u003c Service Mesh 2.2.9", "product": { "name": "Red Hat OpenShift \u003c Service Mesh 2.2.9", "product_id": "T029299", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:service_mesh_2.2.9" } } }, { "category": "product_name", "name": "Red Hat OpenShift \u003c Service Mesh 2.3.6 Containers", "product": { "name": "Red Hat OpenShift \u003c Service Mesh 2.3.6 Containers", "product_id": "T029300", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:service_mesh_2.3.6_containers" } } }, { "category": "product_name", "name": "Red Hat OpenShift \u003c Service Mesh 2.4.2 Containers", "product": { "name": "Red Hat OpenShift \u003c Service Mesh 2.4.2 Containers", "product_id": "T029301", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:service_mesh_2.4.2_containers" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-35945", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-35945" }, { "cve": "CVE-2023-35944", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-35944" }, { "cve": "CVE-2023-35943", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-35943" }, { "cve": "CVE-2023-35942", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-35942" }, { "cve": "CVE-2023-35941", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-35941" }, { "cve": "CVE-2023-27496", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-27496" }, { "cve": "CVE-2023-27493", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-27493" }, { "cve": "CVE-2023-27492", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-27492" }, { "cve": "CVE-2023-27491", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-27491" }, { "cve": "CVE-2023-27488", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-27488" }, { "cve": "CVE-2023-27487", "notes": [ { "category": "description", "text": "In Red Hat OpenShift Service Mesh und Service Mesh Containers, sowie Red Hat Enterprise Linux existieren mehrere Schwachstellen in der Komponente \"Envoy\". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T002207", "67646", "398363", "T004914" ] }, "release_date": "2023-08-13T22:00:00Z", "title": "CVE-2023-27487" } ] }
gsd-2023-27488
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service. When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2023-27488", "id": "GSD-2023-27488" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2023-27488" ], "details": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service. When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`.", "id": "GSD-2023-27488", "modified": "2023-12-13T01:20:55.444076Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2023-27488", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "envoy", "version": { "version_data": [ { "version_affected": "=", "version_value": "\u003e= 1.25.0, \u003c1.25.3" }, { "version_affected": "=", "version_value": "\u003e= 1.24.0, \u003c 1.24.4" }, { "version_affected": "=", "version_value": "\u003e= 1.23.0, \u003c 1.23.6" }, { "version_affected": "=", "version_value": "\u003c 1.22.9" } ] } } ] }, "vendor_name": "envoyproxy" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service. When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`." } ] }, "impact": { "cvss": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1" } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "cweId": "CWE-20", "lang": "eng", "value": "CWE-20: Improper Input Validation" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph", "refsource": "MISC", "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph" } ] }, "source": { "advisory": "GHSA-9g5w-hqr3-w2ph", "discovery": "UNKNOWN" } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.25.3", "versionStartIncluding": "1.25.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.24.4", "versionStartIncluding": "1.24.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.23.6", "versionStartIncluding": "1.23.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.22.9", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "security-advisories@github.com", "ID": "CVE-2023-27488" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when `failure_mode_allow: true` is configured for `ext_authz` filter. For affected components that are used for logging and/or visibility, requests may not be logged by the receiving service. When Envoy was configured to use ext_authz, ext_proc, tap, ratelimit filters, and grpc access log service and an http header with non-UTF-8 data was received, Envoy would generate an invalid protobuf message and send it to the configured service. The receiving service would typically generate an error when decoding the protobuf message. For ext_authz that was configured with ``failure_mode_allow: true``, the request would have been allowed in this case. For the other services, this could have resulted in other unforeseen errors such as a lack of visibility into requests. As of versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy by default sanitizes the values sent in gRPC service calls to be valid UTF-8, replacing data that is not valid UTF-8 with a `!` character. This behavioral change can be temporarily reverted by setting runtime guard `envoy.reloadable_features.service_sanitize_non_utf8_strings` to false. As a workaround, one may set `failure_mode_allow: false` for `ext_authz`." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "NVD-CWE-noinfo" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph", "refsource": "MISC", "tags": [ "Exploit", "Mitigation", "Vendor Advisory" ], "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9g5w-hqr3-w2ph" } ] } }, "impact": { "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "lastModifiedDate": "2023-04-11T14:42Z", "publishedDate": "2023-04-04T18:15Z" } } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.