RHSA-2022:1276HighCVSS 9.4

Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update

Published
April 7, 2022
Last Modified
August 15, 2026

🔗 CVE IDs covered (16)

CVE-2022-21654 →CVE-2021-3749 →CVE-2021-43565 →CVE-2021-43826 →CVE-2022-23606 →CVE-2022-23635 →CVE-2020-28851 →CVE-2020-28852 →CVE-2021-36221 →CVE-2021-3121 →CVE-2021-29482 →CVE-2021-29923 →CVE-2021-43824 →CVE-2021-43825 →CVE-2022-21655 →CVE-2022-24726 →

📋 Description

CVE-2020-28851 — golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension CVE-2020-28852 — golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag CVE-2021-3121 — gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain index validation CVE-2021-3749 — nodejs-axios: Regular expression denial of service in trim function CVE-2021-29482 — ulikunitz/xz: Infinite loop in readUvarint allows for denial of service CVE-2021-29923 — golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet CVE-2021-36221 — golang: net/http/httputil: panic due to racy read of persistConn after handler panic CVE-2021-43565 — golang.org/x/crypto: empty plaintext packet causes panic CVE-2021-43824 — envoy: Null pointer dereference when using JWT filter safe_regex match CVE-2021-43825 — envoy: Use-after-free when response filters increase response data CVE-2021-43826 — envoy: Use-after-free when tunneling TCP over HTTP CVE-2022-21654 — envoy: Incorrect configuration handling allows mTLS session re-use without re-validation CVE-2022-21655 — envoy: Incorrect handling of internal redirects to routes with a direct response entry CVE-2022-23606 — envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service CVE-2022-23635 — istio: unauthenticated control plane denial of service attack CVE-2022-24726 — istio: Unauthenticated control plane denial of service attack due to stack exhaustion

🎯 Affected products40

  • OpenShift Service Mesh 2.0
  • kiali-0:v1.24.7.redhat1-1.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • kiali-0:v1.24.7.redhat1-1.el8.s390x as a component of OpenShift Service Mesh 2.0
  • kiali-0:v1.24.7.redhat1-1.el8.src as a component of OpenShift Service Mesh 2.0
  • kiali-0:v1.24.7.redhat1-1.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.9-3.el8.src as a component of OpenShift Service Mesh 2.0
  • servicemesh-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.9-3.el8.src as a component of OpenShift Service Mesh 2.0
  • servicemesh-cni-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-istioctl-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-istioctl-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-istioctl-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixc-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixc-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixc-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixs-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixs-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-mixs-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.9-3.el8.src as a component of OpenShift Service Mesh 2.0
  • servicemesh-operator-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-agent-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-agent-0:2.0.9-3.el8.s390x as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-agent-0:2.0.9-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0
  • servicemesh-pilot-discovery-0:2.0.9-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0
  • +10 more not shown

✅ Remediation

The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (19)