gsd-2022-39278
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.
Aliases
Aliases
CVE-2022-39278


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-39278",
    "description": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.",
    "id": "GSD-2022-39278",
    "references": [
      "https://access.redhat.com/errata/RHSA-2023:0542"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-39278"
      ],
      "details": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.",
      "id": "GSD-2022-39278",
      "modified": "2023-12-13T01:19:20.927333Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-39278",
        "STATE": "PUBLIC",
        "TITLE": "Istio vulnerable to denial of service attack due to Golang Regex Library"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "istio",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 1.13.9"
                        },
                        {
                          "version_value": "\u003e= 1.14.0, \u003c 1.14.5"
                        },
                        {
                          "version_value": "\u003e= 1.15.0, \u003c 1.15.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "istio"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-400: Uncontrolled Resource Consumption"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w",
            "refsource": "CONFIRM",
            "url": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w"
          },
          {
            "name": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/",
            "refsource": "MISC",
            "url": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/"
          },
          {
            "name": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/",
            "refsource": "MISC",
            "url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/"
          },
          {
            "name": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/",
            "refsource": "MISC",
            "url": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-86vr-4wcv-mm9w",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.13.9||\u003e=1.14.0 \u003c1.14.5||\u003e=1.15.0 \u003c1.15.2",
          "affected_versions": "All versions before 1.13.9, all versions starting from 1.14.0 before 1.14.5, all versions starting from 1.15.0 before 1.15.2",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-400",
            "CWE-937"
          ],
          "date": "2022-10-19",
          "description": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.",
          "fixed_versions": [
            "1.13.9",
            "1.14.5",
            "1.15.2"
          ],
          "identifier": "CVE-2022-39278",
          "identifiers": [
            "CVE-2022-39278",
            "GHSA-86vr-4wcv-mm9w"
          ],
          "not_impacted": "All versions starting from 1.13.9 before 1.14.0, all versions starting from 1.14.5 before 1.15.0, all versions starting from 1.15.2",
          "package_slug": "go/github.com/istio/istio",
          "pubdate": "2022-10-13",
          "solution": "Upgrade to versions 1.13.9, 1.14.5, 1.15.2 or above.",
          "title": "Uncontrolled Resource Consumption",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-39278",
            "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/",
            "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w",
            "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/",
            "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
          ],
          "uuid": "928f5fba-84f6-4cdb-9904-54c60486f35c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.15.2",
                "versionStartIncluding": "1.15.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.14.5",
                "versionStartIncluding": "1.14.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.9",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-39278"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/"
            },
            {
              "name": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w"
            },
            {
              "name": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/"
            },
            {
              "name": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-10-19T14:24Z",
      "publishedDate": "2022-10-13T23:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.