CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-3495 – kiali/kiali-operator: can deploy specified image to any namespace
https://notcve.org/view.php?id=CVE-2021-3495
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo de control de acceso incorrecto en kiali-operator en versiones anteriores a 1.33.0 y versiones anteriores a 1.24.7. este fallo permite a un atacante con un nivel básico de acceso al clúster (para implementar un operando kiali) usar esta vulnerabilidad e implementar una imagen determinada en cualquier lugar del clúster, potencialmente consiguiendo acceso a tokens de cuentas de servicio privilegiadas. La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos, así como la disponibilidad del sistema An incorrect access control flaw was found in the kiali-operator. • https://bugzilla.redhat.com/show_bug.cgi?id=1947361 https://kiali.io/news/security-bulletins/kiali-security-003 https://access.redhat.com/security/cve/CVE-2021-3495 • CWE-281: Improper Preservation of Permissions •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-25014 – istio-pilot: requests to debug api can result in panic
https://notcve.org/view.php?id=CVE-2019-25014
A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular HTTP GET request is made to the pilot API endpoint, it is possible to cause the Go runtime to panic (resulting in a denial of service to the istio-pilot application). Se encontró una desreferencia del puntero NULL en el archivo pkg/proxy/envoy/v2/debug.go en la función getResourceVersion en Istio pilot versiones anteriores a 1.5.0-alpha.0. Si es realizado una petición HTTP GET en particular al endpoint de la API pilot, es posible que el tiempo de ejecución de Go entre en pánico (resultando en una denegación de servicio para la aplicación istio-pilot) An out-of-bounds read flaw was found in istio-pilot. This flaw allows an attacker to send a crafted HTTP GET request to the pilot debug API endpoint. • https://bugzilla.redhat.com/show_bug.cgi?id=1919066 https://github.com/istio/istio/compare/1.4.2...1.5.0-alpha.0 https://access.redhat.com/security/cve/CVE-2019-25014 • CWE-125: Out-of-bounds Read CWE-476: NULL Pointer Dereference •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1762 – kiali: ignoring JWT claim fields
https://notcve.org/view.php?id=CVE-2020-1762
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration. Se encontró una vulnerabilidad de comprobación de JWT insuficiente en Kiali versiones 0.4.0 hasta la versión 1.15.0, y fue corregido en la versión 1.15.1, en la que un atacante remoto podría abusar de este fallo al robar una cookie JWT válida y usarla para falsificar una sesión de usuario, posiblemente obteniendo privilegios para visualizar y alterar la configuración de Istio. An insufficient JWT validation vulnerability was found in Kiali, versions 0.4.0 to 1.15.0. A remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762 https://kiali.io/news/security-bulletins/kiali-security-001 https://access.redhat.com/security/cve/CVE-2020-1762 https://bugzilla.redhat.com/show_bug.cgi?id=1810387 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 1CVE-2020-1764 – kiali: JWT cookie uses default signing key
https://notcve.org/view.php?id=CVE-2020-1764
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration. Se detectó una vulnerabilidad de clave criptográfica embebida en el archivo de configuración predeterminado en Kiali, todas las versiones anteriores a 1.15.1. Un atacante remoto podría abusar de este fallo mediante la creación de sus propios tokens firmados JWT y omisión de los mecanismos de autenticación de Kiali, posiblemente obteniendo privilegios para visualizar y alterar la configuración de Istio. A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764 https://kiali.io/news/security-bulletins/kiali-security-001 https://access.redhat.com/security/cve/CVE-2020-1764 https://bugzilla.redhat.com/show_bug.cgi?id=1810383 • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-8659 – envoy: Excessive CPU and/or memory usage when proxying HTTP/1.1
https://notcve.org/view.php?id=CVE-2020-8659
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. CNCF Envoy versiones hasta 1.13.0, puede consumir cantidades excesivas de memoria cuando se hace proxy a peticiones o respuestas HTTP/1.1 con muchos fragmentos pequeños (es decir, 1 byte). A resource consumption vulnerability was found in the servicemesh-proxy in Envoy. An attacker could send specially crafted small HTTP/1.1 packets that, when processed, could cause excessive amounts of memory to be used, possibly degrading or crashing the application. • https://access.redhat.com/errata/RHSA-2020:0734 https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history https://access.redhat.com/security/cve/CVE-2020-8659 https://bugzilla.redhat.com/show_bug.cgi?id=1802539 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •