var-202202-0887
Vulnerability from variot
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade. Envoy Exists in a certificate validation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. No detailed vulnerability details are currently available. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Important: Red Hat OpenShift Service Mesh 2.0.9 security update Advisory ID: RHSA-2022:1276-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2022:1276 Issue date: 2022-04-07 CVE Names: CVE-2020-28851 CVE-2020-28852 CVE-2021-3121 CVE-2021-3749 CVE-2021-29482 CVE-2021-29923 CVE-2021-36221 CVE-2021-43565 CVE-2021-43824 CVE-2021-43825 CVE-2021-43826 CVE-2022-21654 CVE-2022-21655 CVE-2022-23606 CVE-2022-23635 CVE-2022-24726 =====================================================================
- Summary:
Red Hat OpenShift Service Mesh 2.0.9.
Red Hat Product Security has rated this update as having a security impact of Important.
- Relevant releases/architectures:
2.0 - ppc64le, s390x, x86_64
- Description:
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
This advisory covers the RPM packages for the release.
Security Fix(es):
-
gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation (CVE-2021-3121)
-
envoy: Incorrect configuration handling allows mTLS session re-use without re-validation (CVE-2022-21654)
-
envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)
-
istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)
-
golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing
-
-u- extension (CVE-2020-28851)
-
golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)
-
nodejs-axios: Regular expression denial of service in trim function (CVE-2021-3749)
-
ulikunitz/xz: Infinite loop in readUvarint allows for denial of service (CVE-2021-29482)
-
golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet (CVE-2021-29923)
-
golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)
-
golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)
-
envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)
-
envoy: Use-after-free when response filters increase response data (CVE-2021-43825)
-
envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)
-
envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)
-
istio: unauthenticated control plane denial of service attack (CVE-2022-23635)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
The OpenShift Service Mesh release notes provide information on the features and known issues:
https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
- Bugs fixed (https://bugzilla.redhat.com/):
1913333 - CVE-2020-28851 golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension 1913338 - CVE-2020-28852 golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag 1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation 1954368 - CVE-2021-29482 ulikunitz/xz: Infinite loop in readUvarint allows for denial of service 1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet 1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic 1999784 - CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim function 2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic 2050744 - CVE-2021-43824 envoy: Null pointer dereference when using JWT filter safe_regex match 2050746 - CVE-2021-43825 envoy: Use-after-free when response filters increase response data 2050748 - CVE-2021-43826 envoy: Use-after-free when tunneling TCP over HTTP 2050753 - CVE-2022-21654 envoy: Incorrect configuration handling allows mTLS session re-use without re-validation 2050757 - CVE-2022-21655 envoy: Incorrect handling of internal redirects to routes with a direct response entry 2050758 - CVE-2022-23606 envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service 2057277 - CVE-2022-23635 istio: unauthenticated control plane denial of service attack 2061638 - CVE-2022-24726 istio: Unauthenticated control plane denial of service attack due to stack exhaustion
- Package List:
2.0:
Source: kiali-v1.24.7.redhat1-1.el8.src.rpm servicemesh-2.0.9-3.el8.src.rpm servicemesh-cni-2.0.9-3.el8.src.rpm servicemesh-operator-2.0.9-3.el8.src.rpm servicemesh-prometheus-2.14.0-16.el8.1.src.rpm servicemesh-proxy-2.0.9-3.el8.src.rpm
ppc64le: kiali-v1.24.7.redhat1-1.el8.ppc64le.rpm servicemesh-2.0.9-3.el8.ppc64le.rpm servicemesh-cni-2.0.9-3.el8.ppc64le.rpm servicemesh-istioctl-2.0.9-3.el8.ppc64le.rpm servicemesh-mixc-2.0.9-3.el8.ppc64le.rpm servicemesh-mixs-2.0.9-3.el8.ppc64le.rpm servicemesh-operator-2.0.9-3.el8.ppc64le.rpm servicemesh-pilot-agent-2.0.9-3.el8.ppc64le.rpm servicemesh-pilot-discovery-2.0.9-3.el8.ppc64le.rpm servicemesh-prometheus-2.14.0-16.el8.1.ppc64le.rpm servicemesh-proxy-2.0.9-3.el8.ppc64le.rpm
s390x: kiali-v1.24.7.redhat1-1.el8.s390x.rpm servicemesh-2.0.9-3.el8.s390x.rpm servicemesh-cni-2.0.9-3.el8.s390x.rpm servicemesh-istioctl-2.0.9-3.el8.s390x.rpm servicemesh-mixc-2.0.9-3.el8.s390x.rpm servicemesh-mixs-2.0.9-3.el8.s390x.rpm servicemesh-operator-2.0.9-3.el8.s390x.rpm servicemesh-pilot-agent-2.0.9-3.el8.s390x.rpm servicemesh-pilot-discovery-2.0.9-3.el8.s390x.rpm servicemesh-prometheus-2.14.0-16.el8.1.s390x.rpm servicemesh-proxy-2.0.9-3.el8.s390x.rpm
x86_64: kiali-v1.24.7.redhat1-1.el8.x86_64.rpm servicemesh-2.0.9-3.el8.x86_64.rpm servicemesh-cni-2.0.9-3.el8.x86_64.rpm servicemesh-istioctl-2.0.9-3.el8.x86_64.rpm servicemesh-mixc-2.0.9-3.el8.x86_64.rpm servicemesh-mixs-2.0.9-3.el8.x86_64.rpm servicemesh-operator-2.0.9-3.el8.x86_64.rpm servicemesh-pilot-agent-2.0.9-3.el8.x86_64.rpm servicemesh-pilot-discovery-2.0.9-3.el8.x86_64.rpm servicemesh-prometheus-2.14.0-16.el8.1.x86_64.rpm servicemesh-proxy-2.0.9-3.el8.x86_64.rpm
These packages are GPG signed by Red Hat for security. References:
https://access.redhat.com/security/cve/CVE-2020-28851 https://access.redhat.com/security/cve/CVE-2020-28852 https://access.redhat.com/security/cve/CVE-2021-3121 https://access.redhat.com/security/cve/CVE-2021-3749 https://access.redhat.com/security/cve/CVE-2021-29482 https://access.redhat.com/security/cve/CVE-2021-29923 https://access.redhat.com/security/cve/CVE-2021-36221 https://access.redhat.com/security/cve/CVE-2021-43565 https://access.redhat.com/security/cve/CVE-2021-43824 https://access.redhat.com/security/cve/CVE-2021-43825 https://access.redhat.com/security/cve/CVE-2021-43826 https://access.redhat.com/security/cve/CVE-2022-21654 https://access.redhat.com/security/cve/CVE-2022-21655 https://access.redhat.com/security/cve/CVE-2022-23606 https://access.redhat.com/security/cve/CVE-2022-23635 https://access.redhat.com/security/cve/CVE-2022-24726 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBYk9i6NzjgjWX9erEAQjAEhAAmnMX+Vmxv+BfSR/1KoiT5lCYoO0yCwR3 L2bDIAzohd4RaxbTxTRGGg0ibXB22Helse0hfroV/ZVQDhEcVg07QDwB7bdHknz6 hD1YtqBPLY93Vt2bvUq3XQNpv/hcxK9zngW0j4IeB4kRb0TbIz41yb+0SAKHmHqG KkcyqHeUvh/N02Rp4Ylk+B+Rcjfwwu3KJToUl+YwoajitIiu7np7qkftQ5s+uO2u nuxXdSm67L/WiaCq+LBLJpxk7zmZVtq3kTkqiokHFlSpS9NJCMDWvhpbXG1owkiV du9kUoZYa1hAIonX/URZ7HtOgwBOfaa9Jo0vwLp1GkCZEN389mo7+SkM1A/WGsdN rPwS2pe6HNNqSORHM9aoygraBTZeYyzSTCnVIRIggDbCb8DfG+WdITIEM/Jk9UFS +WSSDbJ9oVNPZtXqImtqxT+0FKHdk9My0UWWpJci3XeV6zL7+1ApcPTib7Y0sbRi XBxeV7THZdyiNHk49xE6i96z5QJFkRL/VCgBx3CaiHVqOAv27cR3O6MrP904utyh f3zUPSYIezvUgq65D13XZTruitBd4wMDTPpCqpsBM5JzLoyObKoU/KIr7oasJkbM 5gKHsNsszEfYgaqFmkao55xHHrZLt7x+WaF6dAttUAbl6AalJmEY3C9UcHYIZlGa 8V4YhC5zIXU= =/fvC -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . JIRA issues fixed (https://issues.jboss.org/):
OSSM-1074 - Pod annotations defined in SMCP are not injected in the pods OSSM-1234 - RPM Release for Maistra 2.1.2 OSSM-303 - Control Openshift Route Creation for ingress Gateways
7
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202202-0887",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "envoy",
"scope": "lt",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.20.2"
},
{
"model": "envoy",
"scope": "lt",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.21.1"
},
{
"model": "envoy",
"scope": "lt",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.18.6"
},
{
"model": "envoy",
"scope": "gte",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.21.0"
},
{
"model": "envoy",
"scope": "gte",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.20.0"
},
{
"model": "envoy",
"scope": "gte",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.7.0"
},
{
"model": "envoy",
"scope": "gte",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.19.0"
},
{
"model": "envoy",
"scope": "lt",
"trust": 1.0,
"vendor": "envoyproxy",
"version": "1.19.3"
},
{
"model": "envoy",
"scope": null,
"trust": 0.8,
"vendor": "envoy proxy",
"version": null
},
{
"model": "envoy",
"scope": "eq",
"trust": 0.8,
"vendor": "envoy proxy",
"version": null
},
{
"model": "envoy",
"scope": null,
"trust": 0.6,
"vendor": "envoy",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.18.6",
"versionStartIncluding": "1.7.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.19.3",
"versionStartIncluding": "1.19.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.20.2",
"versionStartIncluding": "1.20.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.21.1",
"versionStartIncluding": "1.21.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "166643"
},
{
"db": "PACKETSTORM",
"id": "166644"
}
],
"trust": 0.2
},
"cve": "CVE-2022-21654",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2022-21654",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "CNVD-2022-15535",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"author": "security-advisories@github.com",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.2,
"impactScore": 5.2,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-21654",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2022-21654",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "security-advisories@github.com",
"id": "CVE-2022-21654",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2022-15535",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202202-1762",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULMON",
"id": "CVE-2022-21654",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy\u0027s tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade. Envoy Exists in a certificate validation vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. No detailed vulnerability details are currently available. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: Red Hat OpenShift Service Mesh 2.0.9 security update\nAdvisory ID: RHSA-2022:1276-01\nProduct: Red Hat OpenShift Service Mesh\nAdvisory URL: https://access.redhat.com/errata/RHSA-2022:1276\nIssue date: 2022-04-07\nCVE Names: CVE-2020-28851 CVE-2020-28852 CVE-2021-3121 \n CVE-2021-3749 CVE-2021-29482 CVE-2021-29923 \n CVE-2021-36221 CVE-2021-43565 CVE-2021-43824 \n CVE-2021-43825 CVE-2021-43826 CVE-2022-21654 \n CVE-2022-21655 CVE-2022-23606 CVE-2022-23635 \n CVE-2022-24726 \n=====================================================================\n\n1. Summary:\n\nRed Hat OpenShift Service Mesh 2.0.9. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. \n\n2. Relevant releases/architectures:\n\n2.0 - ppc64le, s390x, x86_64\n\n3. Description:\n\nRed Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio\nservice mesh project, tailored for installation into an on-premise\nOpenShift Container Platform installation. \n\nThis advisory covers the RPM packages for the release. \n\nSecurity Fix(es):\n\n* gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index\nvalidation (CVE-2021-3121)\n\n* envoy: Incorrect configuration handling allows mTLS session re-use\nwithout re-validation (CVE-2022-21654)\n\n* envoy: Incorrect handling of internal redirects to routes with a direct\nresponse entry (CVE-2022-21655)\n\n* istio: Unauthenticated control plane denial of service attack due to\nstack exhaustion (CVE-2022-24726)\n\n* golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing\n- -u- extension (CVE-2020-28851)\n\n* golang.org/x/text: Panic in language.ParseAcceptLanguage while processing\nbcp47 tag (CVE-2020-28852)\n\n* nodejs-axios: Regular expression denial of service in trim function\n(CVE-2021-3749)\n\n* ulikunitz/xz: Infinite loop in readUvarint allows for denial of service\n(CVE-2021-29482)\n\n* golang: net: incorrect parsing of extraneous zero characters at the\nbeginning of an IP address octet (CVE-2021-29923)\n\n* golang: net/http/httputil: panic due to racy read of persistConn after\nhandler panic (CVE-2021-36221)\n\n* golang.org/x/crypto: empty plaintext packet causes panic (CVE-2021-43565)\n\n* envoy: Null pointer dereference when using JWT filter safe_regex match\n(CVE-2021-43824)\n\n* envoy: Use-after-free when response filters increase response data\n(CVE-2021-43825)\n\n* envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)\n\n* envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery\nService (CVE-2022-23606)\n\n* istio: unauthenticated control plane denial of service attack\n(CVE-2022-23635)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nThe OpenShift Service Mesh release notes provide information on the\nfeatures and known issues:\n\nhttps://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1913333 - CVE-2020-28851 golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension\n1913338 - CVE-2020-28852 golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag\n1921650 - CVE-2021-3121 gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation\n1954368 - CVE-2021-29482 ulikunitz/xz: Infinite loop in readUvarint allows for denial of service\n1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet\n1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic\n1999784 - CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim function\n2030787 - CVE-2021-43565 golang.org/x/crypto: empty plaintext packet causes panic\n2050744 - CVE-2021-43824 envoy: Null pointer dereference when using JWT filter safe_regex match\n2050746 - CVE-2021-43825 envoy: Use-after-free when response filters increase response data\n2050748 - CVE-2021-43826 envoy: Use-after-free when tunneling TCP over HTTP\n2050753 - CVE-2022-21654 envoy: Incorrect configuration handling allows mTLS session re-use without re-validation\n2050757 - CVE-2022-21655 envoy: Incorrect handling of internal redirects to routes with a direct response entry\n2050758 - CVE-2022-23606 envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service\n2057277 - CVE-2022-23635 istio: unauthenticated control plane denial of service attack\n2061638 - CVE-2022-24726 istio: Unauthenticated control plane denial of service attack due to stack exhaustion\n\n6. Package List:\n\n2.0:\n\nSource:\nkiali-v1.24.7.redhat1-1.el8.src.rpm\nservicemesh-2.0.9-3.el8.src.rpm\nservicemesh-cni-2.0.9-3.el8.src.rpm\nservicemesh-operator-2.0.9-3.el8.src.rpm\nservicemesh-prometheus-2.14.0-16.el8.1.src.rpm\nservicemesh-proxy-2.0.9-3.el8.src.rpm\n\nppc64le:\nkiali-v1.24.7.redhat1-1.el8.ppc64le.rpm\nservicemesh-2.0.9-3.el8.ppc64le.rpm\nservicemesh-cni-2.0.9-3.el8.ppc64le.rpm\nservicemesh-istioctl-2.0.9-3.el8.ppc64le.rpm\nservicemesh-mixc-2.0.9-3.el8.ppc64le.rpm\nservicemesh-mixs-2.0.9-3.el8.ppc64le.rpm\nservicemesh-operator-2.0.9-3.el8.ppc64le.rpm\nservicemesh-pilot-agent-2.0.9-3.el8.ppc64le.rpm\nservicemesh-pilot-discovery-2.0.9-3.el8.ppc64le.rpm\nservicemesh-prometheus-2.14.0-16.el8.1.ppc64le.rpm\nservicemesh-proxy-2.0.9-3.el8.ppc64le.rpm\n\ns390x:\nkiali-v1.24.7.redhat1-1.el8.s390x.rpm\nservicemesh-2.0.9-3.el8.s390x.rpm\nservicemesh-cni-2.0.9-3.el8.s390x.rpm\nservicemesh-istioctl-2.0.9-3.el8.s390x.rpm\nservicemesh-mixc-2.0.9-3.el8.s390x.rpm\nservicemesh-mixs-2.0.9-3.el8.s390x.rpm\nservicemesh-operator-2.0.9-3.el8.s390x.rpm\nservicemesh-pilot-agent-2.0.9-3.el8.s390x.rpm\nservicemesh-pilot-discovery-2.0.9-3.el8.s390x.rpm\nservicemesh-prometheus-2.14.0-16.el8.1.s390x.rpm\nservicemesh-proxy-2.0.9-3.el8.s390x.rpm\n\nx86_64:\nkiali-v1.24.7.redhat1-1.el8.x86_64.rpm\nservicemesh-2.0.9-3.el8.x86_64.rpm\nservicemesh-cni-2.0.9-3.el8.x86_64.rpm\nservicemesh-istioctl-2.0.9-3.el8.x86_64.rpm\nservicemesh-mixc-2.0.9-3.el8.x86_64.rpm\nservicemesh-mixs-2.0.9-3.el8.x86_64.rpm\nservicemesh-operator-2.0.9-3.el8.x86_64.rpm\nservicemesh-pilot-agent-2.0.9-3.el8.x86_64.rpm\nservicemesh-pilot-discovery-2.0.9-3.el8.x86_64.rpm\nservicemesh-prometheus-2.14.0-16.el8.1.x86_64.rpm\nservicemesh-proxy-2.0.9-3.el8.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-28851\nhttps://access.redhat.com/security/cve/CVE-2020-28852\nhttps://access.redhat.com/security/cve/CVE-2021-3121\nhttps://access.redhat.com/security/cve/CVE-2021-3749\nhttps://access.redhat.com/security/cve/CVE-2021-29482\nhttps://access.redhat.com/security/cve/CVE-2021-29923\nhttps://access.redhat.com/security/cve/CVE-2021-36221\nhttps://access.redhat.com/security/cve/CVE-2021-43565\nhttps://access.redhat.com/security/cve/CVE-2021-43824\nhttps://access.redhat.com/security/cve/CVE-2021-43825\nhttps://access.redhat.com/security/cve/CVE-2021-43826\nhttps://access.redhat.com/security/cve/CVE-2022-21654\nhttps://access.redhat.com/security/cve/CVE-2022-21655\nhttps://access.redhat.com/security/cve/CVE-2022-23606\nhttps://access.redhat.com/security/cve/CVE-2022-23635\nhttps://access.redhat.com/security/cve/CVE-2022-24726\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2022 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYk9i6NzjgjWX9erEAQjAEhAAmnMX+Vmxv+BfSR/1KoiT5lCYoO0yCwR3\nL2bDIAzohd4RaxbTxTRGGg0ibXB22Helse0hfroV/ZVQDhEcVg07QDwB7bdHknz6\nhD1YtqBPLY93Vt2bvUq3XQNpv/hcxK9zngW0j4IeB4kRb0TbIz41yb+0SAKHmHqG\nKkcyqHeUvh/N02Rp4Ylk+B+Rcjfwwu3KJToUl+YwoajitIiu7np7qkftQ5s+uO2u\nnuxXdSm67L/WiaCq+LBLJpxk7zmZVtq3kTkqiokHFlSpS9NJCMDWvhpbXG1owkiV\ndu9kUoZYa1hAIonX/URZ7HtOgwBOfaa9Jo0vwLp1GkCZEN389mo7+SkM1A/WGsdN\nrPwS2pe6HNNqSORHM9aoygraBTZeYyzSTCnVIRIggDbCb8DfG+WdITIEM/Jk9UFS\n+WSSDbJ9oVNPZtXqImtqxT+0FKHdk9My0UWWpJci3XeV6zL7+1ApcPTib7Y0sbRi\nXBxeV7THZdyiNHk49xE6i96z5QJFkRL/VCgBx3CaiHVqOAv27cR3O6MrP904utyh\nf3zUPSYIezvUgq65D13XZTruitBd4wMDTPpCqpsBM5JzLoyObKoU/KIr7oasJkbM\n5gKHsNsszEfYgaqFmkao55xHHrZLt7x+WaF6dAttUAbl6AalJmEY3C9UcHYIZlGa\n8V4YhC5zIXU=\n=/fvC\n-----END PGP SIGNATURE-----\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n. JIRA issues fixed (https://issues.jboss.org/):\n\nOSSM-1074 - Pod annotations defined in SMCP are not injected in the pods\nOSSM-1234 - RPM Release for Maistra 2.1.2\nOSSM-303 - Control Openshift Route Creation for ingress Gateways\n\n7",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-21654"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"db": "PACKETSTORM",
"id": "166643"
},
{
"db": "PACKETSTORM",
"id": "166644"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-21654",
"trust": 4.1
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "166644",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2022-15535",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.1505",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1762",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2022-21654",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "166643",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "PACKETSTORM",
"id": "166643"
},
{
"db": "PACKETSTORM",
"id": "166644"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"id": "VAR-202202-0887",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
}
]
},
"last_update_date": "2024-02-13T21:28:22.928000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "CVE-2022-21654 GitHub",
"trust": 0.8,
"url": "https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353"
},
{
"title": "Patch for Envoy Trust Management Issue Vulnerability (CNVD-2022-15535)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/322716"
},
{
"title": "Envoy Repair measures for trust management problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=184623"
},
{
"title": "Red Hat: Important: Red Hat OpenShift Service Mesh 2.1.2 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20221275 - security advisory"
},
{
"title": "Red Hat: Important: Red Hat OpenShift Service Mesh 2.0.9 security update",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20221276 - security advisory"
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-23305 "
},
{
"title": "CVE-2022-XXXX",
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-rce "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-295",
"trust": 1.0
},
{
"problemtype": "Illegal certificate verification (CWE-295) [ others ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21654"
},
{
"trust": 1.7,
"url": "https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353"
},
{
"trust": 1.7,
"url": "https://github.com/envoyproxy/envoy/security/advisories/ghsa-5j4x-g36v-m283"
},
{
"trust": 0.8,
"url": "https://access.redhat.com/security/cve/cve-2022-21654"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.1505"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/166644/red-hat-security-advisory-2022-1275-01.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-21654/"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/errata/rhsa-2022:1275"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-43825"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43826"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-24726"
},
{
"trust": 0.2,
"url": "https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43825"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23635"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-23606"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-24726"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-21655"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-23635"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-43824"
},
{
"trust": 0.2,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2021-43826"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2022-21655"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-23606"
},
{
"trust": 0.2,
"url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43824"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/alphabugx/cve-2022-23305"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-43565"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2022:1276"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-28852"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3121"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-3749"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-28851"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3121"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-3749"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-29482"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-29923"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-43565"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-29482"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-36221"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-28852"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-36221"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2021-29923"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/security/cve/cve-2020-28851"
},
{
"trust": 0.1,
"url": "https://issues.jboss.org/):"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "PACKETSTORM",
"id": "166643"
},
{
"db": "PACKETSTORM",
"id": "166644"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"db": "PACKETSTORM",
"id": "166643"
},
{
"db": "PACKETSTORM",
"id": "166644"
},
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
},
{
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-01T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"date": "2022-02-22T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"date": "2023-06-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"date": "2022-04-08T15:05:23",
"db": "PACKETSTORM",
"id": "166643"
},
{
"date": "2022-04-08T15:06:03",
"db": "PACKETSTORM",
"id": "166644"
},
{
"date": "2022-02-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202202-1762"
},
{
"date": "2022-02-22T23:15:11.103000",
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-03-01T00:00:00",
"db": "CNVD",
"id": "CNVD-2022-15535"
},
{
"date": "2022-03-03T00:00:00",
"db": "VULMON",
"id": "CVE-2022-21654"
},
{
"date": "2023-06-30T06:53:00",
"db": "JVNDB",
"id": "JVNDB-2022-006114"
},
{
"date": "2022-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202202-1762"
},
{
"date": "2022-03-03T18:11:35.557000",
"db": "NVD",
"id": "CVE-2022-21654"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Envoy\u00a0 Certificate validation vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-006114"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202202-1762"
}
],
"trust": 0.6
}
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.