GSD-2022-39278

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.
Aliases
Aliases
CVE-2022-39278
To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-39278",
    "description": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.",
    "id": "GSD-2022-39278",
    "references": [
      "https://access.redhat.com/errata/RHSA-2023:0542"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-39278"
      ],
      "details": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.",
      "id": "GSD-2022-39278",
      "modified": "2023-12-13T01:19:20.927333Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-39278",
        "STATE": "PUBLIC",
        "TITLE": "Istio vulnerable to denial of service attack due to Golang Regex Library"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "istio",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 1.13.9"
                        },
                        {
                          "version_value": "\u003e= 1.14.0, \u003c 1.14.5"
                        },
                        {
                          "version_value": "\u003e= 1.15.0, \u003c 1.15.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "istio"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-400: Uncontrolled Resource Consumption"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w",
            "refsource": "CONFIRM",
            "url": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w"
          },
          {
            "name": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/",
            "refsource": "MISC",
            "url": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/"
          },
          {
            "name": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/",
            "refsource": "MISC",
            "url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/"
          },
          {
            "name": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/",
            "refsource": "MISC",
            "url": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-86vr-4wcv-mm9w",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.13.9||\u003e=1.14.0 \u003c1.14.5||\u003e=1.15.0 \u003c1.15.2",
          "affected_versions": "All versions before 1.13.9, all versions starting from 1.14.0 before 1.14.5, all versions starting from 1.15.0 before 1.15.2",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cwe_ids": [
            "CWE-1035",
            "CWE-400",
            "CWE-937"
          ],
          "date": "2022-10-19",
          "description": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.",
          "fixed_versions": [
            "1.13.9",
            "1.14.5",
            "1.15.2"
          ],
          "identifier": "CVE-2022-39278",
          "identifiers": [
            "CVE-2022-39278",
            "GHSA-86vr-4wcv-mm9w"
          ],
          "not_impacted": "All versions starting from 1.13.9 before 1.14.0, all versions starting from 1.14.5 before 1.15.0, all versions starting from 1.15.2",
          "package_slug": "go/github.com/istio/istio",
          "pubdate": "2022-10-13",
          "solution": "Upgrade to versions 1.13.9, 1.14.5, 1.15.2 or above.",
          "title": "Uncontrolled Resource Consumption",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-39278",
            "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/",
            "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w",
            "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/",
            "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
          ],
          "uuid": "928f5fba-84f6-4cdb-9904-54c60486f35c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.15.2",
                "versionStartIncluding": "1.15.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.14.5",
                "versionStartIncluding": "1.14.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.9",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-39278"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/"
            },
            {
              "name": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w"
            },
            {
              "name": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/"
            },
            {
              "name": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-10-19T14:24Z",
      "publishedDate": "2022-10-13T23:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.