Red Hat Product Errata RHSA-2022:1275 - Security Advisory
Issued:
2022-04-07
Updated:
2022-04-07

RHSA-2022:1275 - Security Advisory

Synopsis

Important: Red Hat OpenShift Service Mesh 2.1.2 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Red Hat OpenShift Service Mesh 2.1.2

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service
mesh project, tailored for installation into an on-premise OpenShift Container
Platform installation.

This advisory covers the RPM packages for the release.

Security Fix(es):

  • envoy: Incorrect configuration handling allows mTLS session re-use without re-validation (CVE-2022-21654)
  • envoy: Incorrect handling of internal redirects to routes with a direct response entry (CVE-2022-21655)
  • istio: Unauthenticated control plane denial of service attack due to stack exhaustion (CVE-2022-24726)
  • envoy: Null pointer dereference when using JWT filter safe_regex match (CVE-2021-43824)
  • envoy: Use-after-free when response filters increase response data (CVE-2021-43825)
  • envoy: Use-after-free when tunneling TCP over HTTP (CVE-2021-43826)
  • envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service (CVE-2022-23606)
  • istio: unauthenticated control plane denial of service attack (CVE-2022-23635)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

The OpenShift Service Mesh Release Notes provide information on the features and known issues:

https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html

Affected Products

  • Red Hat OpenShift Service Mesh 2.1 for RHEL 8 x86_64
  • Red Hat OpenShift Service Mesh for Power 2.1 for RHEL 8 ppc64le
  • Red Hat OpenShift Service Mesh for IBM Z 2.1 for RHEL 8 s390x

Fixes

  • BZ - 2050744 - CVE-2021-43824 envoy: Null pointer dereference when using JWT filter safe_regex match
  • BZ - 2050746 - CVE-2021-43825 envoy: Use-after-free when response filters increase response data
  • BZ - 2050748 - CVE-2021-43826 envoy: Use-after-free when tunneling TCP over HTTP
  • BZ - 2050753 - CVE-2022-21654 envoy: Incorrect configuration handling allows mTLS session re-use without re-validation
  • BZ - 2050757 - CVE-2022-21655 envoy: Incorrect handling of internal redirects to routes with a direct response entry
  • BZ - 2050758 - CVE-2022-23606 envoy: Stack exhaustion when a cluster is deleted via Cluster Discovery Service
  • BZ - 2057277 - CVE-2022-23635 istio: unauthenticated control plane denial of service attack
  • BZ - 2061638 - CVE-2022-24726 istio: Unauthenticated control plane denial of service attack due to stack exhaustion
  • OSSM-1074 - Pod annotations defined in SMCP are not injected in the pods
  • OSSM-1234 - RPM Release for Maistra 2.1.2
  • OSSM-303 - Control Openshift Route Creation for ingress Gateways

Red Hat OpenShift Service Mesh 2.1 for RHEL 8

SRPM
servicemesh-2.1.2-4.el8.src.rpm SHA-256: 13d14eae923c00daf319b1fe8fa728ebff239bd330fc9dc0c462bd69adacc8fe
servicemesh-operator-2.1.2-4.el8.src.rpm SHA-256: d32c7b24f2dc571981e12036162f06f43970bbbd4c84bd256daf3f00316d37df
servicemesh-prometheus-2.23.0-5.el8.src.rpm SHA-256: abbe43a646ad35189c37ab4ebf5922ba20ca0bec9aa657d30d31b04a5a83aea8
servicemesh-proxy-2.1.2-4.el8.src.rpm SHA-256: 9ea989f79293b8eb60ca4084cafe63128f6a8e93eb21806aaa069158813768ed
servicemesh-ratelimit-2.1.2-4.el8.src.rpm SHA-256: dac895e8e5ed443222fe170b3ca6c9932c43c978a40341b0c7f5e7e7712fc88d
x86_64
servicemesh-2.1.2-4.el8.x86_64.rpm SHA-256: 95e91ec577eebd2137dbc5967fda2fbc758ed08ec89b0dec9cd51c955a6bb991
servicemesh-cni-2.1.2-4.el8.x86_64.rpm SHA-256: 77fb2bd8bbd4bdfecf0b5d37c457718a59509407ffdd38359d7c14b434048a41
servicemesh-operator-2.1.2-4.el8.x86_64.rpm SHA-256: f7dedee97f7748f2a820dc7cf8234c7090d9a461183e91fa6b4919ad09e79e2d
servicemesh-pilot-agent-2.1.2-4.el8.x86_64.rpm SHA-256: a6e38aa1e7bbf2b8e8dedf627ec184976ea2372a9b4b1a70139099897284a0cd
servicemesh-pilot-discovery-2.1.2-4.el8.x86_64.rpm SHA-256: 9177029813be1473eef2dbf76660fe4b086963fe6e2a22f848a683c89553a6d8
servicemesh-prometheus-2.23.0-5.el8.x86_64.rpm SHA-256: 344c695e513ecf57a247bd593c64aed328e07bbb383b8ecf1e6f1da9b970becc
servicemesh-proxy-2.1.2-4.el8.x86_64.rpm SHA-256: 4b07f0477e3bf25d419b015735ad1cfa1bfb60cf5f93bee857700782211a64bc
servicemesh-proxy-debuginfo-2.1.2-4.el8.x86_64.rpm SHA-256: b6993b41206706aef7de843123f452875cfc82be3f56a2f873379667910056dc
servicemesh-proxy-debugsource-2.1.2-4.el8.x86_64.rpm SHA-256: cbfd0bba76e55a80a539f09697083db2655021b30d130566f4271cd132a91a82
servicemesh-proxy-wasm-2.1.2-4.el8.noarch.rpm SHA-256: 8cc9329d7fc0fd108a5a7408214d3b4840491d79fc6143c12eccfaa0f6f8d86c
servicemesh-ratelimit-2.1.2-4.el8.x86_64.rpm SHA-256: 5c954f0bc4906ca4815a85f8e58fff5c8432fdcdfcb679b6902add788b459470

Red Hat OpenShift Service Mesh for Power 2.1 for RHEL 8

SRPM
servicemesh-2.1.2-4.el8.src.rpm SHA-256: 13d14eae923c00daf319b1fe8fa728ebff239bd330fc9dc0c462bd69adacc8fe
servicemesh-operator-2.1.2-4.el8.src.rpm SHA-256: d32c7b24f2dc571981e12036162f06f43970bbbd4c84bd256daf3f00316d37df
servicemesh-prometheus-2.23.0-5.el8.src.rpm SHA-256: abbe43a646ad35189c37ab4ebf5922ba20ca0bec9aa657d30d31b04a5a83aea8
servicemesh-proxy-2.1.2-4.el8.src.rpm SHA-256: 9ea989f79293b8eb60ca4084cafe63128f6a8e93eb21806aaa069158813768ed
servicemesh-ratelimit-2.1.2-4.el8.src.rpm SHA-256: dac895e8e5ed443222fe170b3ca6c9932c43c978a40341b0c7f5e7e7712fc88d
ppc64le
servicemesh-2.1.2-4.el8.ppc64le.rpm SHA-256: 044a9e6e2784506976e94d3129c6bbb32f7ef212f1e924ade35e11fbbbbebdd2
servicemesh-cni-2.1.2-4.el8.ppc64le.rpm SHA-256: 78c93adfc55fd5fb2ba378686410103dec969965ad767bc590840912bcda0ba8
servicemesh-operator-2.1.2-4.el8.ppc64le.rpm SHA-256: 8701569b4c01b270f9ca047e4998f474a30e0ebb4242228ae881fa94d672bd00
servicemesh-pilot-agent-2.1.2-4.el8.ppc64le.rpm SHA-256: f435991a4fba08c816b17d30cd3ee7f770279151a0d86243accf5942c080cb60
servicemesh-pilot-discovery-2.1.2-4.el8.ppc64le.rpm SHA-256: 70a458441ce2aa1c5d7f0ed008999a239f4d4f382640f7ee3210902eb9b777d8
servicemesh-prometheus-2.23.0-5.el8.ppc64le.rpm SHA-256: a92a521e94f8cec0eaaaff5830b5294f03c5738478366d2b3305b92f41957869
servicemesh-proxy-2.1.2-4.el8.ppc64le.rpm SHA-256: 3bca07e3c01ae3cc04851bcb4ca338bf061f5b074bb56228d8a5c4e0c363a912
servicemesh-proxy-debuginfo-2.1.2-4.el8.ppc64le.rpm SHA-256: d4b105dc4e1dfba0d112d6f54caa78be88c26e3ab3edbd856c9c7f2d7f912acd
servicemesh-proxy-debugsource-2.1.2-4.el8.ppc64le.rpm SHA-256: 6e84cf5dae701b96e13e1df1d3a539d68d2f7a7020c3cd93f69350fe1f418546
servicemesh-proxy-wasm-2.1.2-4.el8.noarch.rpm SHA-256: 8cc9329d7fc0fd108a5a7408214d3b4840491d79fc6143c12eccfaa0f6f8d86c
servicemesh-ratelimit-2.1.2-4.el8.ppc64le.rpm SHA-256: 81646c8a39316f208accce4a7c2e0081a91c4b960ff3d4283620995f58da22c2

Red Hat OpenShift Service Mesh for IBM Z 2.1 for RHEL 8

SRPM
servicemesh-2.1.2-4.el8.src.rpm SHA-256: 13d14eae923c00daf319b1fe8fa728ebff239bd330fc9dc0c462bd69adacc8fe
servicemesh-operator-2.1.2-4.el8.src.rpm SHA-256: d32c7b24f2dc571981e12036162f06f43970bbbd4c84bd256daf3f00316d37df
servicemesh-prometheus-2.23.0-5.el8.src.rpm SHA-256: abbe43a646ad35189c37ab4ebf5922ba20ca0bec9aa657d30d31b04a5a83aea8
servicemesh-proxy-2.1.2-4.el8.src.rpm SHA-256: 9ea989f79293b8eb60ca4084cafe63128f6a8e93eb21806aaa069158813768ed
servicemesh-ratelimit-2.1.2-4.el8.src.rpm SHA-256: dac895e8e5ed443222fe170b3ca6c9932c43c978a40341b0c7f5e7e7712fc88d
s390x
servicemesh-2.1.2-4.el8.s390x.rpm SHA-256: 673ef08d0dbe425b8335a59c7c8969e1a57109614f62b580a85fadc9a602ed91
servicemesh-cni-2.1.2-4.el8.s390x.rpm SHA-256: 0fa5448afc2b4145066d93536ddccd2a0cb322674ec4c4f7aa6606cb0d5bcbe8
servicemesh-operator-2.1.2-4.el8.s390x.rpm SHA-256: f4c603162983ca51e9a6f53872430db59c57042b2272e3896415b300772f9d5e
servicemesh-pilot-agent-2.1.2-4.el8.s390x.rpm SHA-256: 31046a2f63c15861b235c14b136836170ebc18bdd019deb1e3a7013effa95607
servicemesh-pilot-discovery-2.1.2-4.el8.s390x.rpm SHA-256: ab4c0a5be2275f922a2824775b8a6231539a97812e52bcab8724291241264231
servicemesh-prometheus-2.23.0-5.el8.s390x.rpm SHA-256: 4c76625412dea020d9ab0cf0c8a9adf37af9c6ee109f4aed82b4ec2df1c355d4
servicemesh-proxy-2.1.2-4.el8.s390x.rpm SHA-256: 979bc43b6205c30a9ab8e96d37376a1b5e5e290d50650e1fc62e7bae5f91e867
servicemesh-proxy-debuginfo-2.1.2-4.el8.s390x.rpm SHA-256: be5310229702fb6d0db3e3f18a0d3d70254ab1f926d7eceadd90685f7f950b17
servicemesh-proxy-debugsource-2.1.2-4.el8.s390x.rpm SHA-256: 96f0faacd5788ff04f5970ad0acfa1908cf55d12baad10fb2bf40afd3439b837
servicemesh-proxy-wasm-2.1.2-4.el8.noarch.rpm SHA-256: 8cc9329d7fc0fd108a5a7408214d3b4840491d79fc6143c12eccfaa0f6f8d86c
servicemesh-ratelimit-2.1.2-4.el8.s390x.rpm SHA-256: 4991d721a11a42c22528e25ae885caf127ef87ad1d788db9f14ec0f3dd0122b6

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.