Vulnerability-Lookup

RHSA-2022:1275

Vulnerability from csaf_redhat - Published: 2022-04-07 18:06 - Updated: 2026-03-26 12:10

Summary

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2 security update

Severity

Important

Notes

Topic: Red Hat OpenShift Service Mesh 2.1.2 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. This advisory covers the RPM packages for the release. Security Fix(es): * envoy: Incorrect configuration handling allows mTLS session re-use without re-validation (CVE-2022-21654) * envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655) * istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726) * envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824) * envoy: Use-after-free when response filters increase response data (CVE-2021-43825) * envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826) * envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606) * istio: unauthenticated control plane denial of service attack (CVE-2022-23635) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-43824

A flaw was found in envoy. A crafted request can potentially trigger a NULL pointer dereference when using a WT filter safe_regex match.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 11 products

Product	Version	Remediation
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch	—	Vendor Fix fix

Known not affected 25 products

Product	Identifier	Version	Remediation
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64		—

Threats

Impact Moderate

CVE-2021-43825

A flaw was found in envoy. If the amount of buffered data by envoy goes over the limit, the buffer may overflow while a response is being processed by the filter chain. This issue possibly causes the operation to abort incorrectly, resulting in the access of a freed memory block.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 11 products, the same list as for CVE-2021-43824

Known not affected 25 products, the same list as for CVE-2021-43824

Threats

Impact Moderate

CVE-2021-43826

A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 11 products, the same list as for CVE-2021-43824

Known not affected 25 products, the same list as for CVE-2021-43824

Threats

Impact Moderate

CVE-2022-21654

A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation.

9.4 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 11 products, the same list as for CVE-2021-43824

Known not affected 25 products, the same list as for CVE-2021-43824

Threats

Impact Important

CVE-2022-21655

A flaw was found in envoy. Due to incorrect handling of the common router, a segfault is possible when internal redirects are routes with a direct response entry.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-670 - Always-Incorrect Control Flow Implementation

Affected products

Fixed 11 products, the same list as for CVE-2021-43824

Known not affected 25 products, the same list as for CVE-2021-43824

Threats

Impact Important

CVE-2022-23606

A flaw was found in envoy. When a cluster is deleted via the Cluster Discovery Service, a stack exhaustion may occur.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 11 products, the same list as for CVE-2021-43824

Known not affected 25 products, the same list as for CVE-2021-43824

Threats

Impact Moderate

CVE-2022-23635

A flaw was found in istio. This flaw allows an attacker to send a specially crafted message to isitiod, causing the control plane to crash.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-287 - Improper Authentication

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x	—	Vendor Fix fix
Unresolved product id: 8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64	—	Vendor Fix fix

Known not affected 23 products

Product	Identifier	Version	Remediation
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src		—
Unresolved product id: 8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64		—

Threats

Impact Moderate

CVE-2022-24726

A stack exhaustion flaw was found in the Istio control plane. This flaw allows a remote unauthenticated attacker to send a specially crafted or oversized message to crash the control plane process, resulting in a denial of service condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 13 products, the same list as for CVE-2022-23635

Known not affected 23 products, the same list as for CVE-2022-23635

Threats

Impact Important

References

54 references

URL	Category
https://access.redhat.com/errata/RHSA-2022:1275	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2050744	external
https://bugzilla.redhat.com/show_bug.cgi?id=2050746	external
https://bugzilla.redhat.com/show_bug.cgi?id=2050748	external
https://bugzilla.redhat.com/show_bug.cgi?id=2050753	external
https://bugzilla.redhat.com/show_bug.cgi?id=2050757	external
https://bugzilla.redhat.com/show_bug.cgi?id=2050758	external
https://bugzilla.redhat.com/show_bug.cgi?id=2057277	external
https://bugzilla.redhat.com/show_bug.cgi?id=2061638	external
https://issues.redhat.com/browse/OSSM-1074	external
https://issues.redhat.com/browse/OSSM-1234	external
https://issues.redhat.com/browse/OSSM-303	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-43824	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050744	external
https://www.cve.org/CVERecord?id=CVE-2021-43824	external
https://nvd.nist.gov/vuln/detail/CVE-2021-43824	external
https://github.com/envoyproxy/envoy/security/advi…	external
https://access.redhat.com/security/cve/CVE-2021-43825	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050746	external
https://www.cve.org/CVERecord?id=CVE-2021-43825	external
https://nvd.nist.gov/vuln/detail/CVE-2021-43825	external
https://github.com/envoyproxy/envoy/security/advi…	external
https://access.redhat.com/security/cve/CVE-2021-43826	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050748	external
https://www.cve.org/CVERecord?id=CVE-2021-43826	external
https://nvd.nist.gov/vuln/detail/CVE-2021-43826	external
https://github.com/envoyproxy/envoy/security/advi…	external
https://access.redhat.com/security/cve/CVE-2022-21654	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050753	external
https://www.cve.org/CVERecord?id=CVE-2022-21654	external
https://nvd.nist.gov/vuln/detail/CVE-2022-21654	external
https://github.com/envoyproxy/envoy/security/advi…	external
https://access.redhat.com/security/cve/CVE-2022-21655	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050757	external
https://www.cve.org/CVERecord?id=CVE-2022-21655	external
https://nvd.nist.gov/vuln/detail/CVE-2022-21655	external
https://github.com/envoyproxy/envoy/security/advi…	external
https://access.redhat.com/security/cve/CVE-2022-23606	self
https://bugzilla.redhat.com/show_bug.cgi?id=2050758	external
https://www.cve.org/CVERecord?id=CVE-2022-23606	external
https://nvd.nist.gov/vuln/detail/CVE-2022-23606	external
https://github.com/envoyproxy/envoy/security/advi…	external
https://access.redhat.com/security/cve/CVE-2022-23635	self
https://bugzilla.redhat.com/show_bug.cgi?id=2057277	external
https://www.cve.org/CVERecord?id=CVE-2022-23635	external
https://nvd.nist.gov/vuln/detail/CVE-2022-23635	external
https://istio.io/latest/news/security/istio-secur…	external
https://access.redhat.com/security/cve/CVE-2022-24726	self
https://bugzilla.redhat.com/show_bug.cgi?id=2061638	external
https://www.cve.org/CVERecord?id=CVE-2022-24726	external
https://nvd.nist.gov/vuln/detail/CVE-2022-24726	external
https://istio.io/latest/news/security/istio-secur…	external

Acknowledgments

Istio Product Security Working Group Oliver Liu, John Howard and Jacob Delgado

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Service Mesh 2.1.2\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service\nmesh project, tailored for installation into an on-premise OpenShift Container\nPlatform installation.\n\nThis advisory covers the RPM packages for the release.\n\nSecurity Fix(es):\n\n* envoy: Incorrect configuration handling allows mTLS session re-use without re-validation (CVE-2022-21654)\n\n* envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)\n\n* istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)\n\n* envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)\n\n* envoy: Use-after-free when response filters increase response data (CVE-2021-43825)\n\n* envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)\n\n* envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)\n\n* istio: unauthenticated control plane denial of service attack (CVE-2022-23635)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:1275",
        "url": "https://access.redhat.com/errata/RHSA-2022:1275"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2050744",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050744"
      },
      {
        "category": "external",
        "summary": "2050746",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050746"
      },
      {
        "category": "external",
        "summary": "2050748",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050748"
      },
      {
        "category": "external",
        "summary": "2050753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050753"
      },
      {
        "category": "external",
        "summary": "2050757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050757"
      },
      {
        "category": "external",
        "summary": "2050758",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050758"
      },
      {
        "category": "external",
        "summary": "2057277",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2057277"
      },
      {
        "category": "external",
        "summary": "2061638",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2061638"
      },
      {
        "category": "external",
        "summary": "OSSM-1074",
        "url": "https://issues.redhat.com/browse/OSSM-1074"
      },
      {
        "category": "external",
        "summary": "OSSM-1234",
        "url": "https://issues.redhat.com/browse/OSSM-1234"
      },
      {
        "category": "external",
        "summary": "OSSM-303",
        "url": "https://issues.redhat.com/browse/OSSM-303"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1275.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2 security update",
    "tracking": {
      "current_release_date": "2026-03-26T12:10:31+00:00",
      "generator": {
        "date": "2026-03-26T12:10:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.4"
        }
      },
      "id": "RHSA-2022:1275",
      "initial_release_date": "2022-04-07T18:06:45+00:00",
      "revision_history": [
        {
          "date": "2022-04-07T18:06:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-04-07T18:06:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-26T12:10:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Service Mesh 2.1",
                "product": {
                  "name": "OpenShift Service Mesh 2.1",
                  "product_id": "8Base-OSSM-2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:service_mesh:2.1::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Service Mesh"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "servicemesh-operator-0:2.1.2-4.el8.src",
                "product": {
                  "name": "servicemesh-operator-0:2.1.2-4.el8.src",
                  "product_id": "servicemesh-operator-0:2.1.2-4.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-operator@2.1.2-4.el8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-0:2.1.2-4.el8.src",
                "product": {
                  "name": "servicemesh-0:2.1.2-4.el8.src",
                  "product_id": "servicemesh-0:2.1.2-4.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh@2.1.2-4.el8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-ratelimit-0:2.1.2-4.el8.src",
                "product": {
                  "name": "servicemesh-ratelimit-0:2.1.2-4.el8.src",
                  "product_id": "servicemesh-ratelimit-0:2.1.2-4.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-ratelimit@2.1.2-4.el8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-prometheus-0:2.23.0-5.el8.src",
                "product": {
                  "name": "servicemesh-prometheus-0:2.23.0-5.el8.src",
                  "product_id": "servicemesh-prometheus-0:2.23.0-5.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.23.0-5.el8?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-0:2.1.2-4.el8.src",
                "product": {
                  "name": "servicemesh-proxy-0:2.1.2-4.el8.src",
                  "product_id": "servicemesh-proxy-0:2.1.2-4.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy@2.1.2-4.el8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "servicemesh-operator-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-operator-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-operator-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-operator@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-cni-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-cni-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-cni-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-cni@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-pilot-agent@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-pilot-discovery@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-ratelimit-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-ratelimit-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-ratelimit-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-ratelimit@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
                "product": {
                  "name": "servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
                  "product_id": "servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.23.0-5.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-proxy-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-proxy-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-debugsource@2.1.2-4.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
                "product": {
                  "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
                  "product_id": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-debuginfo@2.1.2-4.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "servicemesh-operator-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-operator-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-operator-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-operator@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-cni-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-cni-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-cni-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-cni@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-pilot-agent@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-pilot-discovery@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-ratelimit@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
                "product": {
                  "name": "servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
                  "product_id": "servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.23.0-5.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-debugsource@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
                "product": {
                  "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
                  "product_id": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-debuginfo@2.1.2-4.el8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "servicemesh-operator-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-operator-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-operator-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-operator@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-cni-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-cni-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-cni-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-cni@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-pilot-agent@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-pilot-discovery@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-ratelimit@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-prometheus-0:2.23.0-5.el8.s390x",
                "product": {
                  "name": "servicemesh-prometheus-0:2.23.0-5.el8.s390x",
                  "product_id": "servicemesh-prometheus-0:2.23.0-5.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-prometheus@2.23.0-5.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-proxy-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-proxy-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-debugsource@2.1.2-4.el8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
                "product": {
                  "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
                  "product_id": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-debuginfo@2.1.2-4.el8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
                "product": {
                  "name": "servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
                  "product_id": "servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/servicemesh-proxy-wasm@2.1.2-4.el8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-0:2.1.2-4.el8.src as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src"
        },
        "product_reference": "servicemesh-0:2.1.2-4.el8.src",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-cni-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-cni-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-cni-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-cni-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-cni-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-cni-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-operator-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-operator-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-operator-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-operator-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-operator-0:2.1.2-4.el8.src as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src"
        },
        "product_reference": "servicemesh-operator-0:2.1.2-4.el8.src",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-operator-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-operator-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus-0:2.23.0-5.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le"
        },
        "product_reference": "servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus-0:2.23.0-5.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x"
        },
        "product_reference": "servicemesh-prometheus-0:2.23.0-5.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus-0:2.23.0-5.el8.src as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src"
        },
        "product_reference": "servicemesh-prometheus-0:2.23.0-5.el8.src",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus-0:2.23.0-5.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64"
        },
        "product_reference": "servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-proxy-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-0:2.1.2-4.el8.src as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src"
        },
        "product_reference": "servicemesh-proxy-0:2.1.2-4.el8.src",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-proxy-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        },
        "product_reference": "servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le"
        },
        "product_reference": "servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-ratelimit-0:2.1.2-4.el8.s390x as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x"
        },
        "product_reference": "servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-ratelimit-0:2.1.2-4.el8.src as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src"
        },
        "product_reference": "servicemesh-ratelimit-0:2.1.2-4.el8.src",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-ratelimit-0:2.1.2-4.el8.x86_64 as a component of OpenShift Service Mesh 2.1",
          "product_id": "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        },
        "product_reference": "servicemesh-ratelimit-0:2.1.2-4.el8.x86_64",
        "relates_to_product_reference": "8Base-OSSM-2.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-43824",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2022-02-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2050744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in envoy. A crafted request can potentially trigger a NULL pointer dereference when using a WT filter safe_regex match.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "envoy: Null pointer dereference when using JWT filter safe_regex match",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2050744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43824"
        },
        {
          "category": "external",
          "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p",
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p"
        }
      ],
      "release_date": "2022-02-22T07:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "envoy: Null pointer dereference when using JWT filter safe_regex match"
    },
    {
      "cve": "CVE-2021-43825",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2022-02-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2050746"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in envoy. If the amount of buffered data by envoy goes over the limit, the buffer may overflow while a response is being processed by the filter chain. This issue possibly causes the operation to abort incorrectly, resulting in the access of a freed memory block.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "envoy: Use-after-free when response filters increase response data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43825"
        },
        {
          "category": "external",
          "summary": "RHBZ#2050746",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050746"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43825",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43825"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43825",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43825"
        },
        {
          "category": "external",
          "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh",
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh"
        }
      ],
      "release_date": "2022-02-22T07:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "envoy: Use-after-free when response filters increase response data"
    },
    {
      "cve": "CVE-2021-43826",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2022-02-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2050748"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in envoy. If a downstream source disconnects during upstream connection establishment when tunneling TCP over HTTP, a use-after-free can occur, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "envoy: Use-after-free when tunneling TCP over HTTP",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43826"
        },
        {
          "category": "external",
          "summary": "RHBZ#2050748",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050748"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43826",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43826"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43826",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43826"
        },
        {
          "category": "external",
          "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf",
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf"
        }
      ],
      "release_date": "2022-02-22T07:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "envoy: Use-after-free when tunneling TCP over HTTP"
    },
    {
      "cve": "CVE-2022-21654",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2022-02-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2050753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "envoy: Incorrect configuration handling allows mTLS session re-use without re-validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21654"
        },
        {
          "category": "external",
          "summary": "RHBZ#2050753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21654",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21654"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21654",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21654"
        },
        {
          "category": "external",
          "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283",
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283"
        }
      ],
      "release_date": "2022-02-22T07:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "envoy: Incorrect configuration handling allows mTLS session re-use without re-validation"
    },
    {
      "cve": "CVE-2022-21655",
      "cwe": {
        "id": "CWE-670",
        "name": "Always-Incorrect Control Flow Implementation"
      },
      "discovery_date": "2022-02-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2050757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in envoy. Due to incorrect handling of the common router, a segfault is possible when internal redirects are routes with a direct response entry.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "envoy: Incorrect handling of internal redirects to routes with a direct response entry",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21655"
        },
        {
          "category": "external",
          "summary": "RHBZ#2050757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21655",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21655"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21655",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21655"
        },
        {
          "category": "external",
          "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg",
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg"
        }
      ],
      "release_date": "2022-02-22T07:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "envoy: Incorrect handling of internal redirects to routes with a direct response entry"
    },
    {
      "cve": "CVE-2022-23606",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2022-02-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2050758"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in envoy. When a cluster is deleted via the Cluster Discovery Service, a stack exhaustion may occur.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23606"
        },
        {
          "category": "external",
          "summary": "RHBZ#2050758",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2050758"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23606",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23606"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23606",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23606"
        },
        {
          "category": "external",
          "summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf",
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf"
        }
      ],
      "release_date": "2022-02-22T07:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service"
    },
    {
      "cve": "CVE-2022-23635",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2022-02-23T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2057277"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in istio. This flaw allows an attacker to send a specially crafted message to isitiod, causing the control plane to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "istio: unauthenticated control plane denial of service attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-23635"
        },
        {
          "category": "external",
          "summary": "RHBZ#2057277",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2057277"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-23635",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-23635"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-23635",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23635"
        },
        {
          "category": "external",
          "summary": "https://istio.io/latest/news/security/istio-security-2022-003",
          "url": "https://istio.io/latest/news/security/istio-security-2022-003"
        }
      ],
      "release_date": "2022-02-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "istio: unauthenticated control plane denial of service attack"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Oliver Liu, John Howard and Jacob Delgado"
          ],
          "organization": "Istio Product Security Working Group",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2022-24726",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2022-03-08T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2061638"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A stack exhaustion flaw was found in the Istio control plane. This flaw allows a remote unauthenticated attacker to send a specially crafted or oversized message to crash the control plane process, resulting in a denial of service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "istio: Unauthenticated control plane denial of service attack due to stack exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64"
        ],
        "known_not_affected": [
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
          "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
          "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
          "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-24726"
        },
        {
          "category": "external",
          "summary": "RHBZ#2061638",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2061638"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24726",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-24726"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24726",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24726"
        },
        {
          "category": "external",
          "summary": "https://istio.io/latest/news/security/istio-security-2022-004/",
          "url": "https://istio.io/latest/news/security/istio-security-2022-004/"
        }
      ],
      "release_date": "2022-03-09T20:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-07T18:06:45+00:00",
          "details": "The OpenShift Service Mesh Release Notes provide information on the features and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html",
          "product_ids": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1275"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-cni-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-operator-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-agent-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-pilot-discovery-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.src",
            "8Base-OSSM-2.1:servicemesh-prometheus-0:2.23.0-5.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-proxy-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debuginfo-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-proxy-debugsource-0:2.1.2-4.el8.x86_64",
            "8Base-OSSM-2.1:servicemesh-proxy-wasm-0:2.1.2-4.el8.noarch",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.ppc64le",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.s390x",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.src",
            "8Base-OSSM-2.1:servicemesh-ratelimit-0:2.1.2-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "istio: Unauthenticated control plane denial of service attack due to stack exhaustion"
    }
  ]
}

CVE-2021-43824 (GCVE-0-2021-43824)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:15 – Updated: 2025-04-23 19:01

Title

Null pointer dereference in envoy

Summary

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:57 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/937133…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
envoyproxy	envoy	Affected: >= 1.20.0, < 1.20.2 Affected: >= 1.19.0, < 1.19.3 Affected: < 1.18.6 Affected: >= 1.21.0, < 1.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:03:09.023Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-43824",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:57:27.390383Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:01:55.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.20.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.19.0, \u003c 1.19.3"
            },
            {
              "status": "affected",
              "version": "\u003c 1.18.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.21.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:15:10.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a"
        }
      ],
      "source": {
        "advisory": "GHSA-vj5m-rch8-5r2p",
        "discovery": "UNKNOWN"
      },
      "title": "Null pointer dereference in envoy",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-43824",
          "STATE": "PUBLIC",
          "TITLE": "Null pointer dereference in envoy"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "envoy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.20.0, \u003c 1.20.2"
                          },
                          {
                            "version_value": "\u003e= 1.19.0, \u003c 1.19.3"
                          },
                          {
                            "version_value": "\u003c 1.18.6"
                          },
                          {
                            "version_value": "\u003e= 1.21.0, \u003c 1.21.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "envoyproxy"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions a crafted request crashes Envoy when a CONNECT request is sent to JWT filter configured with regex match. This provides a denial of service attack vector. The only workaround is to not use regex in the JWT filter. Users are advised to upgrade."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-476: NULL Pointer Dereference"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p",
              "refsource": "CONFIRM",
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/9371333230b1a6e1be2eccf4868771e11af6253a"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-vj5m-rch8-5r2p",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-43824",
    "datePublished": "2022-02-22T22:15:10.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:01:55.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-43825 (GCVE-0-2021-43825)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:45 – Updated: 2025-04-23 19:01

Title

Use-after-free in Envoy

Summary

Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 14:10 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/148de9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
envoyproxy	envoy	Affected: < 1.18.6 Affected: >= 1.19.0, < 1.19.3 Affected: >= 1.20.0, < 1.20.2 Affected: >= 1.21.0, < 1.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:03:08.802Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-43825",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:10:09.261197Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:01:15.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.18.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.19.0, \u003c 1.19.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.20.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.21.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:45:11.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136"
        }
      ],
      "source": {
        "advisory": "GHSA-h69p-g6xg-mhhh",
        "discovery": "UNKNOWN"
      },
      "title": "Use-after-free in Envoy",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-43825",
          "STATE": "PUBLIC",
          "TITLE": "Use-after-free in Envoy"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "envoy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.18.6"
                          },
                          {
                            "version_value": "\u003e= 1.19.0, \u003c 1.19.3"
                          },
                          {
                            "version_value": "\u003e= 1.20.0, \u003c 1.20.2"
                          },
                          {
                            "version_value": "\u003e= 1.21.0, \u003c 1.21.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "envoyproxy"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. Sending a locally generated response must stop further processing of request or response data. Envoy tracks the amount of buffered request and response data and aborts the request if the amount of buffered data is over the limit by sending 413 or 500 responses. However when the buffer overflows while response is processed by the filter chain the operation may not be aborted correctly and result in accessing a freed memory block. If this happens Envoy will crash resulting in a denial of service."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-416: Use After Free"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh",
              "refsource": "CONFIRM",
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/148de954ed3585d8b4298b424aa24916d0de6136"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-h69p-g6xg-mhhh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-43825",
    "datePublished": "2022-02-22T22:45:12.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:01:15.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-43826 (GCVE-0-2021-43826)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:45 – Updated: 2025-04-23 19:01

Title

Crash when tunneling TCP over HTTP in Envoy

Summary

Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling <envoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config>` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:57 UTC

CWE

CWE-416 - Use After Free

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/ce0ae3…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
envoyproxy	envoy	Affected: < 1.18.6 Affected: >= 1.19.0, < 1.19.3 Affected: >= 1.20.0, < 1.20.2 Affected: >= 1.21.0, < 1.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T04:03:09.047Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-43826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:57:19.863004Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:01:09.708Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.18.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.19.0, \u003c 1.19.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.20.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.21.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling \u003cenvoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config\u003e` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:45:22.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145"
        }
      ],
      "source": {
        "advisory": "GHSA-cmx3-fvgf-83mf",
        "discovery": "UNKNOWN"
      },
      "title": "Crash when tunneling TCP over HTTP in Envoy",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-43826",
          "STATE": "PUBLIC",
          "TITLE": "Crash when tunneling TCP over HTTP in Envoy"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "envoy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.18.6"
                          },
                          {
                            "version_value": "\u003e= 1.19.0, \u003c 1.19.3"
                          },
                          {
                            "version_value": "\u003e= 1.20.0, \u003c 1.20.2"
                          },
                          {
                            "version_value": "\u003e= 1.21.0, \u003c 1.21.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "envoyproxy"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions of Envoy a crash occurs when configured for :ref:`upstream tunneling \u003cenvoy_v3_api_field_extensions.filters.network.tcp_proxy.v3.TcpProxy.tunneling_config\u003e` and the downstream connection disconnects while the the upstream connection or http/2 stream is still being established. There are no workarounds for this issue. Users are advised to upgrade."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-416: Use After Free"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf",
              "refsource": "CONFIRM",
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/ce0ae309057a216aba031aff81c445c90c6ef145"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-cmx3-fvgf-83mf",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-43826",
    "datePublished": "2022-02-22T22:45:22.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:01:09.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21654 (GCVE-0-2022-21654)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:35 – Updated: 2025-04-23 19:01

Title

Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

Summary

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:55 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/e9f936…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
envoyproxy	envoy	Affected: >= 1.7.0, < 1.18.6 Affected: >= 1.19.0, < 1.19.3 Affected: >= 1.20.0, < 1.20.2 Affected: >= 1.21.0, < 1.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:39.224Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21654",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:55:41.314206Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:01:27.096Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.18.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.19.0, \u003c 1.19.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.20.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.21.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy\u0027s tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:35:11.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353"
        }
      ],
      "source": {
        "advisory": "GHSA-5j4x-g36v-m283",
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect configuration handling allows TLS session re-use without re-validation in Envoy",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-21654",
          "STATE": "PUBLIC",
          "TITLE": "Incorrect configuration handling allows TLS session re-use without re-validation in Envoy"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "envoy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.7.0, \u003c 1.18.6"
                          },
                          {
                            "version_value": "\u003e= 1.19.0, \u003c 1.19.3"
                          },
                          {
                            "version_value": "\u003e= 1.20.0, \u003c 1.20.2"
                          },
                          {
                            "version_value": "\u003e= 1.21.0, \u003c 1.21.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "envoyproxy"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy\u0027s tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-295: Improper Certificate Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283",
              "refsource": "CONFIRM",
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-5j4x-g36v-m283",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-21654",
    "datePublished": "2022-02-22T22:35:11.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:01:27.096Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-21655 (GCVE-0-2022-21655)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:40 – Updated: 2025-04-23 19:01

Title

Incorrect handling of internal redirects results in crash in Envoy

Summary

Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:57 UTC

CWE

CWE-670 - Always-Incorrect Control Flow Implementation

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/177d60…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
envoyproxy	envoy	Affected: < 1.18.6 Affected: >= 1.19.0, < 1.19.3 Affected: >= 1.20.0, < 1.20.2 Affected: >= 1.21.0, < 1.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:46:39.410Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-21655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:57:22.876617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:01:21.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.18.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.19.0, \u003c 1.19.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.20.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.21.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-670",
              "description": "CWE-670: Always-Incorrect Control Flow Implementation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:40:11.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682"
        }
      ],
      "source": {
        "advisory": "GHSA-7r5p-7fmh-jxpg",
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect handling of internal redirects results in crash in Envoy",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-21655",
          "STATE": "PUBLIC",
          "TITLE": "Incorrect handling of internal redirects results in crash in Envoy"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "envoy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.18.6"
                          },
                          {
                            "version_value": "\u003e= 1.19.0, \u003c 1.19.3"
                          },
                          {
                            "version_value": "\u003e= 1.20.0, \u003c 1.20.2"
                          },
                          {
                            "version_value": "\u003e= 1.21.0, \u003c 1.21.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "envoyproxy"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internal redirect selects a route configured with direct response or redirect actions. This will result in a denial of service. As a workaround turn off internal redirects if direct response entries are configured on the same listener."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-670: Always-Incorrect Control Flow Implementation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg",
              "refsource": "CONFIRM",
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/177d608155ba8b11598b9bbf8240e90d8c350682"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-7r5p-7fmh-jxpg",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-21655",
    "datePublished": "2022-02-22T22:40:11.000Z",
    "dateReserved": "2021-11-16T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:01:21.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-23606 (GCVE-0-2022-23606)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:20 – Updated: 2025-04-23 19:01

Title

Crash when a cluster is deleted in Envoy

Summary

Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 14:10 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/envoyproxy/envoy/security/advi…	x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/4b6dd3…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
envoyproxy	envoy	Affected: >= 1.20.0, < 1.20.2 Affected: >= 1.21.0, < 1.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:43:46.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-23606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:10:12.491502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:01:49.384Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "envoy",
          "vendor": "envoyproxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.20.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.21.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:20:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31"
        }
      ],
      "source": {
        "advisory": "GHSA-9vp2-4cp7-vvxf",
        "discovery": "UNKNOWN"
      },
      "title": "Crash when a cluster is deleted in Envoy",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23606",
          "STATE": "PUBLIC",
          "TITLE": "Crash when a cluster is deleted in Envoy"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "envoy",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.20.0, \u003c 1.20.2"
                          },
                          {
                            "version_value": "\u003e= 1.21.0, \u003c 1.21.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "envoyproxy"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-674: Uncontrolled Recursion"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf",
              "refsource": "CONFIRM",
              "url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf"
            },
            {
              "name": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31",
              "refsource": "MISC",
              "url": "https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522b31"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-9vp2-4cp7-vvxf",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-23606",
    "datePublished": "2022-02-22T22:20:13.000Z",
    "dateReserved": "2022-01-19T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:01:49.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-23635 (GCVE-0-2022-23635)

Vulnerability from cvelistv5 – Published: 2022-02-22 22:00 – Updated: 2025-04-23 19:02

Title

Unauthenticated control plane denial of service attack in Istio

Summary

Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:57 UTC

CWE

CWE-287 - Improper Authentication

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/istio/istio/security/advisorie…	x_refsource_CONFIRM
https://github.com/istio/istio/commit/5f3b5ed958a…	x_refsource_MISC
https://istio.io/latest/news/security/istio-secur…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
istio	istio	Affected: >= 1.13.0, < 1.13.1 Affected: >= 1.12.0, < 1.12.4 Affected: < 1.11.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:45.891Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://istio.io/latest/news/security/istio-security-2022-003"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-23635",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:57:30.373660Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:02:00.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "istio",
          "vendor": "istio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.4"
            },
            {
              "status": "affected",
              "version": "\u003c 1.11.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-22T22:00:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://istio.io/latest/news/security/istio-security-2022-003"
        }
      ],
      "source": {
        "advisory": "GHSA-856q-xv3c-7f2f",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated control plane denial of service attack in Istio",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23635",
          "STATE": "PUBLIC",
          "TITLE": "Unauthenticated control plane denial of service attack in Istio"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "istio",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 1.13.0, \u003c 1.13.1"
                          },
                          {
                            "version_value": "\u003e= 1.12.0, \u003c 1.12.4"
                          },
                          {
                            "version_value": "\u003c 1.11.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "istio"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-287: Improper Authentication"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f",
              "refsource": "CONFIRM",
              "url": "https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f"
            },
            {
              "name": "https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84",
              "refsource": "MISC",
              "url": "https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84"
            },
            {
              "name": "https://istio.io/latest/news/security/istio-security-2022-003",
              "refsource": "MISC",
              "url": "https://istio.io/latest/news/security/istio-security-2022-003"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-856q-xv3c-7f2f",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-23635",
    "datePublished": "2022-02-22T22:00:13.000Z",
    "dateReserved": "2022-01-19T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:02:00.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-24726 (GCVE-0-2022-24726)

Vulnerability from cvelistv5 – Published: 2022-03-10 20:45 – Updated: 2025-04-23 18:55

Title

Unauthenticated control plane denial of service attack in Istio

Summary

Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the validating webhook for a cluster is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [external istiod](https://istio.io/latest/docs/setup/install/external-controlplane/) topologies, this port is exposed over the public internet. This issue has been patched in versions 1.13.2, 1.12.5 and 1.11.8. Users are advised to upgrade. Users unable to upgrade should disable access to a validating webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known, trusted entities.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 15:56 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/istio/istio/security/advisorie…	x_refsource_CONFIRM
https://github.com/golang/go/issues/51112	x_refsource_MISC
https://github.com/istio/istio/commit/6ca5055a4db…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
istio	istio	Affected: < 1.11.8, Affected: >= 1.12.0, < 1.12.5 Affected: >= 1.13.0, < 1.13.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:20:49.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/istio/istio/security/advisories/GHSA-8w5h-qr4r-2h6g"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/golang/go/issues/51112"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-24726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:56:46.812613Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:55:37.983Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "istio",
          "vendor": "istio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.8,"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.12.0, \u003c 1.12.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the validating webhook for a cluster is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [external istiod](https://istio.io/latest/docs/setup/install/external-controlplane/) topologies, this port is exposed over the public internet. This issue has been patched in versions 1.13.2, 1.12.5 and 1.11.8. Users are advised to upgrade. Users unable to upgrade should disable access to a validating webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known, trusted entities."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-10T20:45:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/istio/istio/security/advisories/GHSA-8w5h-qr4r-2h6g"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/golang/go/issues/51112"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd"
        }
      ],
      "source": {
        "advisory": "GHSA-8w5h-qr4r-2h6g",
        "discovery": "UNKNOWN"
      },
      "title": "Unauthenticated control plane denial of service attack in Istio",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-24726",
          "STATE": "PUBLIC",
          "TITLE": "Unauthenticated control plane denial of service attack in Istio"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "istio",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 1.11.8,"
                          },
                          {
                            "version_value": "\u003e= 1.12.0, \u003c 1.12.5"
                          },
                          {
                            "version_value": "\u003e= 1.13.0, \u003c 1.13.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "istio"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing when the validating webhook for a cluster is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [external istiod](https://istio.io/latest/docs/setup/install/external-controlplane/) topologies, this port is exposed over the public internet. This issue has been patched in versions 1.13.2, 1.12.5 and 1.11.8. Users are advised to upgrade. Users unable to upgrade should disable access to a validating webhook that is exposed to the public internet or restrict the set of IP addresses that can query it to a set of known, trusted entities."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400: Uncontrolled Resource Consumption"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/istio/istio/security/advisories/GHSA-8w5h-qr4r-2h6g",
              "refsource": "CONFIRM",
              "url": "https://github.com/istio/istio/security/advisories/GHSA-8w5h-qr4r-2h6g"
            },
            {
              "name": "https://github.com/golang/go/issues/51112",
              "refsource": "MISC",
              "url": "https://github.com/golang/go/issues/51112"
            },
            {
              "name": "https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd",
              "refsource": "MISC",
              "url": "https://github.com/istio/istio/commit/6ca5055a4db6695ef5504eabdfde3799f2ea91fd"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-8w5h-qr4r-2h6g",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-24726",
    "datePublished": "2022-03-10T20:45:12.000Z",
    "dateReserved": "2022-02-10T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:55:37.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2022:1275

CVE-2021-43824 (GCVE-0-2021-43824)

CVE-2021-43825 (GCVE-0-2021-43825)

CVE-2021-43826 (GCVE-0-2021-43826)

CVE-2022-21654 (GCVE-0-2022-21654)

CVE-2022-21655 (GCVE-0-2022-21655)

CVE-2022-23606 (GCVE-0-2022-23606)

CVE-2022-23635 (GCVE-0-2022-23635)

CVE-2022-24726 (GCVE-0-2022-24726)

Tags

Sightings

Nomenclature

Related by attack behaviour