CVE-2021-39156
Fixed in a distro release EPSS 1%CVSS 8.1
Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.
Products: istio
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | istio.io/istio | 1.9.8 |
| Go | istio.io/istio | 1.10.4 |
| Go | istio.io/istio | 1.11.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | cert-manager-istio-csr | 0 |
| Chainguard | cert-manager-istio-csr-compat | 0 |
| Chainguard | cert-manager-istio-csr-compat-fips | 0 |
| Chainguard | cert-manager-istio-csr-fips | 0 |
| Chainguard | istio-cni-1.21 | 1.21.6-r8 |
| Chainguard | istio-cni-1.21 | 0 |
| Chainguard | istio-cni-1.21-compat | 1.21.6-r8 |
| Chainguard | istio-cni-1.21-compat | 0 |
| Chainguard | istio-cni-1.22 | 0 |
| Chainguard | istio-cni-1.22-compat | 0 |
| Chainguard | istio-cni-fips-1.21 | 0 |
| Chainguard | istio-cni-fips-1.21-compat | 0 |
| Chainguard | istio-fips-1.21 | 0 |
| Chainguard | istio-install-cni-1.21 | 1.21.6-r8 |
| Chainguard | istio-install-cni-1.21 | 0 |
| Chainguard | istio-install-cni-1.21-compat | 0 |
| Chainguard | istio-install-cni-1.21-compat | 1.21.6-r8 |
| Chainguard | istio-install-cni-1.22 | 0 |
| Chainguard | istio-install-cni-1.22-compat | 0 |
| Chainguard | istio-install-cni-fips-1.21 | 0 |
| Chainguard | istio-install-cni-fips-1.21-compat | 0 |
| Chainguard | istio-operator-1.20 | 1.20.7-r0 |
| Chainguard | istio-operator-1.21 | 1.21.3-r0 |
| Chainguard | istio-operator-1.21 | 0 |
| Chainguard | istio-operator-1.22 | 0 |
| Chainguard | istio-operator-fips-1.21 | 0 |
| Chainguard | istio-pilot-agent-1.21 | 1.21.3-r0 |
| Chainguard | istio-pilot-agent-1.21 | 0 |
| Chainguard | istio-pilot-agent-1.21-compat | 0 |
| Chainguard | istio-pilot-agent-1.21-compat | 1.21.3-r0 |
| Chainguard | istio-pilot-agent-1.22 | 0 |
| Chainguard | istio-pilot-agent-1.22-compat | 0 |
| Chainguard | istio-pilot-agent-fips-1.21 | 0 |
| Chainguard | istio-pilot-agent-fips-1.21-compat | 0 |
| Chainguard | istio-pilot-discovery-1.21 | 0 |
| Chainguard | istio-pilot-discovery-1.21 | 1.21.3-r0 |
| Chainguard | istio-pilot-discovery-1.21-compat | 0 |
| Chainguard | istio-pilot-discovery-1.21-compat | 1.21.3-r0 |
| Chainguard | istio-pilot-discovery-1.22 | 0 |
| Chainguard | istio-pilot-discovery-1.22-compat | 0 |
| Chainguard | istio-pilot-discovery-fips-1.21 | 0 |
| Chainguard | kgateway-2.3 | 0 |
| Chainguard | kgateway-2.4 | 0 |
| Chainguard | kgateway-fips-2.3 | 0 |
| Chainguard | kgateway-fips-2.4 | 0 |
| Red Hat service mesh 1.1 | servicemesh | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-citadel | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-galley | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-istioctl | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-mixc | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-mixs | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-pilot-agent | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-pilot-discovery | 0:1.1.17-3.el8 |
| Red Hat service mesh 1.1 | servicemesh-proxy | 0:1.1.17-2.el8 |
| Red Hat service mesh 1.1 | servicemesh-sidecar-injector | 0:1.1.17-3.el8 |
| Red Hat service mesh 2.0 | servicemesh | 0:2.0.7-3.el8 |
| Red Hat service mesh 2.0 | servicemesh-istioctl | 0:2.0.7-3.el8 |
| Red Hat service mesh 2.0 | servicemesh-mixc | 0:2.0.7-3.el8 |
| Red Hat service mesh 2.0 | servicemesh-mixs | 0:2.0.7-3.el8 |
| Red Hat service mesh 2.0 | servicemesh-pilot-agent | 0:2.0.7-3.el8 |
| Red Hat service mesh 2.0 | servicemesh-pilot-discovery | 0:2.0.7-3.el8 |
| Red Hat service mesh 2.0 | servicemesh-proxy | 0:2.0.7-3.el8 |
| Wolfi | cert-manager-istio-csr | 0 |
| Wolfi | cert-manager-istio-csr-compat | 0 |
| Wolfi | istio-cni-1.21 | 0 |
| Wolfi | istio-cni-1.21-compat | 0 |
| Wolfi | istio-cni-1.22 | 0 |
| Wolfi | istio-cni-1.22-compat | 0 |
| Wolfi | istio-install-cni-1.21 | 0 |
| Wolfi | istio-install-cni-1.21-compat | 0 |
| Wolfi | istio-install-cni-1.22 | 0 |
| Wolfi | istio-install-cni-1.22-compat | 0 |
| Wolfi | istio-operator-1.21 | 0 |
| Wolfi | istio-operator-1.22 | 0 |
| Wolfi | istio-pilot-agent-1.21 | 0 |
| Wolfi | istio-pilot-agent-1.21-compat | 0 |
| Wolfi | istio-pilot-agent-1.22 | 0 |
| Wolfi | istio-pilot-agent-1.22-compat | 0 |
| Wolfi | istio-pilot-discovery-1.21 | 0 |
| Wolfi | istio-pilot-discovery-1.21-compat | 0 |
| Wolfi | istio-pilot-discovery-1.22 | 0 |
| Wolfi | istio-pilot-discovery-1.22-compat | 0 |