Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.7 servicemesh-proxy security update
Red Hat OpenShift Service Mesh 1.0.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-8595US | high7.3 | — | ||
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Fixedservicemesh-proxy-0:1.0.7-1.el8.src as a component of OpenShift Service Mesh 1.0
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/4.3/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:0477 - Fixedservicemesh-proxy-0:1.0.7-1.el8.x86_64 as a component of OpenShift Service Mesh 1.0
The OpenShift Service Mesh release notes provide information on the features and known issues: https://docs.openshift.com/container-platform/4.3/service_mesh/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2020:0477 - Workaroundservicemesh-proxy-0:1.0.7-1.el8.src as a component of OpenShift Service Mesh 1.0
Depending on the paths used in the exact match clause, it is possible to update the path to a regex. As provided by the Istio Product Committee, the following mitigation can be employed. The original policy specifying a JWT protected path is as follows: --- apiVersion: "authentication.istio.io/v1alpha1" kind: "Policy" metadata: name: "jwt-example" namespace: istio-system spec: targets: - name: istio-ingressgateway origins: - jwt: issuer: "testing@secure.istio.io" jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.4/security/tools/jwt/samples/jwks.json" trigger_rules: - included_paths: - exact: /productpage The exact path definition can then be updated to a regular expression: --- - jwt: issuer: "testing@secure.istio.io" jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.4/security/tools/jwt/samples/jwks.json" trigger_rules: - included_paths: - regex: '/productpage(\?.*)?' - regex: '/productpage(#.*)?'
- Workaroundservicemesh-proxy-0:1.0.7-1.el8.x86_64 as a component of OpenShift Service Mesh 1.0
Depending on the paths used in the exact match clause, it is possible to update the path to a regex. As provided by the Istio Product Committee, the following mitigation can be employed. The original policy specifying a JWT protected path is as follows: --- apiVersion: "authentication.istio.io/v1alpha1" kind: "Policy" metadata: name: "jwt-example" namespace: istio-system spec: targets: - name: istio-ingressgateway origins: - jwt: issuer: "testing@secure.istio.io" jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.4/security/tools/jwt/samples/jwks.json" trigger_rules: - included_paths: - exact: /productpage The exact path definition can then be updated to a regular expression: --- - jwt: issuer: "testing@secure.istio.io" jwksUri: "https://raw.githubusercontent.com/istio/istio/release-1.4/security/tools/jwt/samples/jwks.json" trigger_rules: - included_paths: - regex: '/productpage(\?.*)?' - regex: '/productpage(#.*)?'
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan