GHSA-6g5f-f5pm-mjrgHighCVSS 8.9

Istio may not check inbound TCP connections against istio-policy

Published
February 15, 2022
Last Modified
September 29, 2023

🔗 CVE IDs covered (1)

CVE-2019-12243 →

📋 Description

Istio 1.1.x through 1.1.6 has Incorrect Access Control. When disablePolicyChecks is set to false, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.

This behavior is a result of a change to istio/pilot/pkg/networking/plugin/mixer/mixer.go in 1.1.

🎯 Affected products1

  • go/istio.io/istio:>= 1.1.0, < 1.1.7

🔗 References (5)