CVE-2021-3586

criticalPriorität · verfolgen · 39OT-Risiko · erhöhtEPSS 0.010 · 64. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.03% (64th) EPSS

CVSS 9.8 · critical

Is it mine?

7 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · redhat_csaf

EPSS · bewertet 2026-10-27

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenservicemesh-operator-0:2.0.5-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2021:2380
Behobenservicemesh-operator-0:2.0.5-3.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2021:2380
Behobenservicemesh-operator-0:2.0.5-3.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2021:2380
Behobenservicemesh-operator-0:2.0.5-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
The OpenShift Service Mesh Release Notes provide information on the features and known issues: https://docs.openshift.com/container-platform/latest/service_mesh/v2x/servicemesh-release-notes.html
https://access.redhat.com/errata/RHSA-2021:2380
Workaroundservicemesh-operator-0:2.0.5-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Workaroundservicemesh-operator-0:2.0.5-3.el8.s390x as a component of OpenShift Service Mesh 2.0redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Workaroundservicemesh-operator-0:2.0.5-3.el8.src as a component of OpenShift Service Mesh 2.0redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.
Workaroundservicemesh-operator-0:2.0.5-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0redhat_csaf
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1188USprimärCWE-305US

betroffene Produkte (7)

Betroffene Produkte und Versionsbereiche.

n/a servicemesh-operator≤ Affects v2.0.5.1, Fixed in v2.0.5.2.enisa_euvdEU
redhat openshift service mesh= 2.0nvdUScpe:2.3:a:redhat:openshift_service_mesh:*:*:*:*:*:*:*:*
redhat servicemesh-operator= 2.0.5.1nvdUScpe:2.3:a:redhat:servicemesh-operator:*:*:*:*:*:*:*:*
servicemesh-operator-0:2.0.5-3.el8.ppc64le as a component of OpenShift Service Mesh 2.0alle Versionenfixedredhat_csafUS
servicemesh-operator-0:2.0.5-3.el8.s390x as a component of OpenShift Service Mesh 2.0alle Versionenfixedredhat_csafUS
servicemesh-operator-0:2.0.5-3.el8.src as a component of OpenShift Service Mesh 2.0alle Versionenfixedredhat_csafUS
servicemesh-operator-0:2.0.5-3.el8.x86_64 as a component of OpenShift Service Mesh 2.0alle Versionenfixedredhat_csafUS

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2021:2380Red Hat Security Advisory: servicemesh-operator security update2021-06-10csaf · redhat_csafUS
An update for servicemesh-operator is now available for OpenShift Service Mesh 2.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd redhat_csaf NVD CVE.org MITRE

veröffentlicht 2022-08-22geändert 2026-06-17

verwandt (399)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-41679US	—OT kritisch	31.7% (98th)	Exploit	2026-04-23
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote…
CVE-2025-48927US	—OT kritisch	11.6% (96th)	KEV	2025-05-28
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.
CVE-2023-6448US	critical9.8OT kritisch	2.09% (82nd)	KEV	2023-12-05
Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take…
CVE-2023-27524US	critical9.8OT kritisch	98.1% (100th)	KEV	2023-04-24
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation in…
CVE-2022-24706US	critical9.8OT kritisch	92.5% (100th)	KEV	2022-04-26
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has…

+394 weitere

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan