RHSA-2023:4625HighCVSS 8.6

Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update

Published
August 11, 2023
Last Modified
October 15, 2026

🔗 CVE IDs covered (4)

CVE-2023-35941 →CVE-2023-35943 →CVE-2023-35944 →CVE-2023-35945 →

📋 Description

CVE-2023-35941 — envoy: OAuth2 credentials exploit with permanent validity CVE-2023-35943 — envoy: CORS filter segfault when origin header is removed CVE-2023-35944 — envoy: Incorrect handling of HTTP requests and responses with mixed case schemes CVE-2023-35945 — envoy: HTTP/2 memory leak in nghttp2 codec

🎯 Affected products23

  • RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:0ccff9864bab5e8e594d5063b853f4d91a1384cfc225e4476216d8e574615cb7_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:562b81ae1d60684dcbd7af1642382e88920a13165a348b6b8cc14f0a89c16321_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/grafana-rhel8@sha256:71e3d3cf8e1a5812365695e9f7747a0f86e281b543c3e3a91ea655796a31fa51_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:46abe1e995f4796110c358744084f797a98e9f37258b506fe3406dd213cb6578_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:4c7f85a069b9c50e5ed5c7eb9f5bf453bca43156564878c33092cdc45a1500d2_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-cni-rhel8@sha256:e2d0c6c599336b7db5b7c90e1490d73c029fae204dc086978bb07b0f8d312d06_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:2bb07daadf9c7836a02252e7bc42eba1f43563ed6fcc5ec7c59eb6f9719874db_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:77bfc5c77e343fbeae3e19d390f8598e5f69661fb54c2ced8c0c49eb4d993308_arm64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:8ec88c4a8e3df430fafa5b5b3e623ed111ce1456539bedf29a791995a548c03e_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-must-gather-rhel8@sha256:b54fd04a30412ca92b046728f8ec513237235b18072a4cc7b241ef2586a2145c_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:0ed49691c656ab9916b81a308ed942377760d4019bb2465735b5071c659070f3_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:67227db1a9ccc2b81938f91959df0bba8791010429e619dd39b1f85e4c6cb832_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/istio-rhel8-operator@sha256:8e01420f8a1f0fd72461dd8c377c29c086e4616826bfc128915ff0d468758c18_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:45e7246f67faeefb0b52d789c33e4fd61694a27611e3d98a143f8c0a5c72bb7a_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:ab76505430875f6895fe269156bfefb79e6c08226e8205941760133230a11993_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/pilot-rhel8@sha256:b67fdd91fccee205e74d4fe47aece9ba78f0dee04635dd83f5edcb984e94ad50_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:28d3f0e2bfa0f6cc04275f2cfab1427e2903a403550e5ccf4cc192ab86e784d6_ppc64le as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:d84f04c9a6e03641eed7c55c91c70666c725aaec5c55eb0a4e2ae083c974760d_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/proxyv2-rhel8@sha256:ff9b876604bf6b157e7ba007c9b8569140ba2bc3cac0e9bc928392bfa58558a4_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:1fce10dd8e3903b5391e0176dc1c4f23113d274f68567a3161d9696b1b858ce6_amd64 as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:99f2890cca37225e318ef39d50800ace6e889c7e59d343a92d4343f4fec8d150_s390x as a component of RHOSSM 2.4 for RHEL 8
  • openshift-service-mesh/ratelimit-rhel8@sha256:dd6b2b1f8b90238b885953e22c01bfc62d3243cc8b501c86b40a892e774f2c7a_ppc64le as a component of RHOSSM 2.4 for RHEL 8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258

🔗 References (6)