Issued:
2021-08-25
Updated:
2021-08-25

RHSA-2021:3273 - Security Advisory

Synopsis

Important: Red Hat OpenShift Service Mesh 1.1.17.1 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for servicemesh and servicemesh-proxy is now available for OpenShift Service Mesh 1.1.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

Security Fix(es):

  • envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies (CVE-2021-32777)
  • envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies (CVE-2021-32779)
  • envoyproxy/envoy: denial of service when using extensions that modify request or response sizes (CVE-2021-32781)
  • istio/istio: HTTP request can bypass authorization mechanisms due to case insensitive host comparison (CVE-2021-39155)
  • istio/istio: HTTP request with fragment in URI can bypass authorization mechanisms (CVE-2021-39156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

The OpenShift Service Mesh Release Notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/4.8/service_mesh/v1x/servicemesh-release-notes.html

Affected Products

  • Red Hat OpenShift Service Mesh 1.1 for RHEL 8 x86_64
  • Red Hat OpenShift Service Mesh for Power 1.1 for RHEL 8 ppc64le
  • Red Hat OpenShift Service Mesh for IBM Z 1.1 for RHEL 8 s390x

Fixes

  • BZ - 1996915 - CVE-2021-39156 istio/istio: HTTP request with fragment in URI can bypass authorization mechanisms
  • BZ - 1996929 - CVE-2021-39155 istio/istio: HTTP request can bypass authorization mechanisms due to case insensitive host comparison
  • BZ - 1996933 - CVE-2021-32777 envoyproxy/envoy: HTTP request with multiple value headers can bypass authorization policies
  • BZ - 1996934 - CVE-2021-32779 envoyproxy/envoy: HTTP request with a URL fragment in the URI can bypass authorization policies
  • BZ - 1996935 - CVE-2021-32781 envoyproxy/envoy: denial of service when using extensions that modify request or response sizes

Red Hat OpenShift Service Mesh 1.1 for RHEL 8

SRPM
servicemesh-1.1.17-3.el8.src.rpm SHA-256: 4a213fd21bb57c3b00e192162ca6d3c52c0a9095d797f38eb91eb2b9a9fe5669
servicemesh-proxy-1.1.17-2.el8.src.rpm SHA-256: 65bab9d40ad1c2a69c68ba7653cba3835a90d4a252432075ffd7c32a887f7de5
x86_64
servicemesh-1.1.17-3.el8.x86_64.rpm SHA-256: 1e3da96c73b9b9e0a16372712e39734b06557a4f33a92f0f919cadba919cc6de
servicemesh-citadel-1.1.17-3.el8.x86_64.rpm SHA-256: 6f6d20d52407e04f697b44cc1a7d5c3bd4be986b79d2c20879e421400b537458
servicemesh-galley-1.1.17-3.el8.x86_64.rpm SHA-256: 8d00db28b9efc1f3f1ec1b4c72e9a59e3235da9c02445e51df3e4445da1401b8
servicemesh-istioctl-1.1.17-3.el8.x86_64.rpm SHA-256: fed0dc3a3a8fe0de0591eb5a05f0a561a8ee34e33685b529ac2ba38c6476c515
servicemesh-mixc-1.1.17-3.el8.x86_64.rpm SHA-256: 3af86b1388546bf8fdcb5ad5f45f25475590d6530e8f26a728db3ab78c544c30
servicemesh-mixs-1.1.17-3.el8.x86_64.rpm SHA-256: 5310bba9078e3660a91101494dcf20c462d7a54a7fe8dc782077a312394634ff
servicemesh-pilot-agent-1.1.17-3.el8.x86_64.rpm SHA-256: fe51ff2bdee0ddaa267b699a7d463c6cd04b42a97ed1278bf8ea6ba4f32dbc8d
servicemesh-pilot-discovery-1.1.17-3.el8.x86_64.rpm SHA-256: 3a9ef3cf9854683dd52b8952590c19b4dc1b6514ba90c425da21978917073bc6
servicemesh-proxy-1.1.17-2.el8.x86_64.rpm SHA-256: ffa30f0a34c9459d15b9bf736b7c903d0dc951dbde8050b46de4adfa1aa37ebb
servicemesh-sidecar-injector-1.1.17-3.el8.x86_64.rpm SHA-256: c1dac7d2c47b0ef48ca71fff2fe79298f2e0032d36d3fc61f806ad8609388fcc

Red Hat OpenShift Service Mesh for Power 1.1 for RHEL 8

SRPM
servicemesh-1.1.17-3.el8.src.rpm SHA-256: 4a213fd21bb57c3b00e192162ca6d3c52c0a9095d797f38eb91eb2b9a9fe5669
servicemesh-proxy-1.1.17-2.el8.src.rpm SHA-256: 65bab9d40ad1c2a69c68ba7653cba3835a90d4a252432075ffd7c32a887f7de5
ppc64le
servicemesh-1.1.17-3.el8.ppc64le.rpm SHA-256: a0458c6eb57eb93da1a8c166845bd2a6eef749f9cc571ad39d7ef2587635fd6a
servicemesh-citadel-1.1.17-3.el8.ppc64le.rpm SHA-256: 80ddbce84ccb7fb0a5599b107d14654d5202df6a87dbee937b8be492c4d04f9e
servicemesh-galley-1.1.17-3.el8.ppc64le.rpm SHA-256: 1038a06e29fea0825e26221fb5b2ab89d15a667c564d8ac5a1b210b1fa523482
servicemesh-istioctl-1.1.17-3.el8.ppc64le.rpm SHA-256: 1ec8449ef633073b35030ac51c882cef6d2b685613faa63735f380112e5aa86f
servicemesh-mixc-1.1.17-3.el8.ppc64le.rpm SHA-256: a99e24b04fcb5caa0d0049414ef8e29e1d61c7410e7d800a9d87802ee511fba3
servicemesh-mixs-1.1.17-3.el8.ppc64le.rpm SHA-256: a8ac78ee076464092aa73e03a3f22f19fc35c0e95a135676f1eefdcf6d1cba20
servicemesh-pilot-agent-1.1.17-3.el8.ppc64le.rpm SHA-256: eef5ca223eb0dd89dd8710ce5dc5a9843b6d03c58f3099e3b180fd6977bb0286
servicemesh-pilot-discovery-1.1.17-3.el8.ppc64le.rpm SHA-256: 112b0b8f67363ba3fd69165dda0de10b0bdfd27d0b192b8e172fb16048fdb9cc
servicemesh-proxy-1.1.17-2.el8.ppc64le.rpm SHA-256: b24513875da81e0ebedfc123997308141411977dfbb471f43c13f43a1b59ab07
servicemesh-sidecar-injector-1.1.17-3.el8.ppc64le.rpm SHA-256: 859203f45996ecfbb2633ce1e7265a3c20bab914b060640d07390638ac2e5750

Red Hat OpenShift Service Mesh for IBM Z 1.1 for RHEL 8

SRPM
servicemesh-1.1.17-3.el8.src.rpm SHA-256: 4a213fd21bb57c3b00e192162ca6d3c52c0a9095d797f38eb91eb2b9a9fe5669
servicemesh-proxy-1.1.17-2.el8.src.rpm SHA-256: 65bab9d40ad1c2a69c68ba7653cba3835a90d4a252432075ffd7c32a887f7de5
s390x
servicemesh-1.1.17-3.el8.s390x.rpm SHA-256: 4cd3a2e61eef1cf58b13ed723017a748fea779dd12b65b69cf9825a01d666f27
servicemesh-citadel-1.1.17-3.el8.s390x.rpm SHA-256: b8aef2595ac3cba6f98c12a18844db16dddc516bcd2b388907a8eb696f27fbca
servicemesh-galley-1.1.17-3.el8.s390x.rpm SHA-256: da9e48d67bc96d43f9210cf5a33b14dbc7ef87f81d6962011ca3438f80836c3f
servicemesh-istioctl-1.1.17-3.el8.s390x.rpm SHA-256: b5dfe7728df2af0310380f6dab0ff4d46f28e615abd3f93db50fb720cf36c38b
servicemesh-mixc-1.1.17-3.el8.s390x.rpm SHA-256: 323836032ec9a665ae1bbbe14e2a4f57933b9d3cd876186f324f2620769d6b1b
servicemesh-mixs-1.1.17-3.el8.s390x.rpm SHA-256: 5941d3ed66dd82c281461d3447c6fabcf1b115d123bd5f01ba1e8bcd24ae3a40
servicemesh-pilot-agent-1.1.17-3.el8.s390x.rpm SHA-256: 43957af3b1e3b7bc675688c3611e17ca91b8e6c7b8b4426f1094d2363c68942c
servicemesh-pilot-discovery-1.1.17-3.el8.s390x.rpm SHA-256: 880ec8bfbfffd22292042065bca234e24bf58eb053089bcceab93f6effd2f4ce
servicemesh-proxy-1.1.17-2.el8.s390x.rpm SHA-256: 6ec761bcf6552edb7ffa77818b1e4eec63948aab84488cb472cdcafc8313ec37
servicemesh-sidecar-injector-1.1.17-3.el8.s390x.rpm SHA-256: c5fc72da4139827063d19f85f3740093c697b368903732557e7912f0ca25477c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.