CVE-2022-31045
published 2022-06-09CVE-2022-31045: Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can…
PriorityP352critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.02%
59.2th percentile
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| istio.io | istio | >= 0 < 1.12.18 | 1.12.18 |
| istio.io | istio | >= 1.13.0 < 1.13.5 | 1.13.5 |
| istio.io | istio | >= 1.14.0 < 1.14.1 | 1.14.1 |
| istio | istio | < 1.12.18 | 1.12.18 |
| istio | istio | < 1.12.8 | 1.12.8 |
| istio | istio | — | — |
| istio | istio | — | — |
| istio | istio | — | — |
| istio | istio | >= 1.13.0 < 1.13.5 | 1.13.5 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Ill-formed headers may lead to unexpected behavior in Istio
osv·2022-06-10
CVE-2022-31045 [MEDIUM] Ill-formed headers may lead to unexpected behavior in Istio
Ill-formed headers may lead to unexpected behavior in Istio
### Impact
Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.
You are at most risk if you have an Istio ingress Gateway exposed to external traffic.
### Patches
1.12.8, 1.13.5, 1.14.1
### Workarounds
No.
### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2022-05)
### For more information
If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected])
GHSA
Ill-formed headers may lead to unexpected behavior in Istio
ghsa·2022-06-10
CVE-2022-31045 [MEDIUM] CWE-125 Ill-formed headers may lead to unexpected behavior in Istio
Ill-formed headers may lead to unexpected behavior in Istio
### Impact
Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.
You are at most risk if you have an Istio ingress Gateway exposed to external traffic.
### Patches
1.12.8, 1.13.5, 1.14.1
### Workarounds
No.
### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2022-05)
### For more information
If you have any questions or comments about this advisory, please email us at [[email protected]](mailto:[email protected])
Red Hat
Istio: Unsafe memory access in metadata exchange.
vendor_redhat·2022-06-09·CVSS 7.0
CVE-2022-31045 [HIGH] CWE-125 Istio: Unsafe memory access in metadata exchange.
Istio: Unsafe memory access in metadata exchange.
Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.
A flaw was found in Istio. Memory access violation of ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access, resulting in undefined behavior or crashing.
Package: servicemesh (OpenShift Service Mesh 2.0) - Affected
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-06-09
Published