istio
/
istio.io
mirror of https://github.com/istio/istio.io.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

update links for cves (#13643) 

* update links for cves

* fix content header
This commit is contained in:
jacob-delgado 2023-07-26 11:17:25 -06:00 committed by GitHub
parent 62234064be
commit 9a8e06d32b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
content/en/news/releases/1.16.x/announcing-1.16.7/index.md
View File

@ -17,7 +17,7 @@ This is the last release of Istio 1.16.
## Security update
- __CVE-2023-35941__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __CVE-2023-35942__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __CVE-2023-35943__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __CVE-2023-35944__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.
- __[CVE-2023-35941](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55)__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __[CVE-2023-35942](https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4)__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __[CVE-2023-35943](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq)__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __[CVE-2023-35944](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g)__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.

8
content/en/news/releases/1.17.x/announcing-1.17.5/index.md
View File

@ -15,7 +15,7 @@ This release note describes what’s different between Istio 1.17.4 and 1.17.5.
## Security update
- __CVE-2023-35941__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __CVE-2023-35942__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __CVE-2023-35943__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __CVE-2023-35944__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.
- __[CVE-2023-35941](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55)__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __[CVE-2023-35942](https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4)__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __[CVE-2023-35943](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq)__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __[CVE-2023-35944](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g)__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.

8
content/en/news/releases/1.18.x/announcing-1.18.2/index.md
View File

@ -15,10 +15,10 @@ This release note describes what’s different between Istio 1.18.1 and 1.18.2.
## Security update
- __CVE-2023-35941__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __CVE-2023-35942__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __CVE-2023-35943__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __CVE-2023-35944__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.
- __[CVE-2023-35941](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55)__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __[CVE-2023-35942](https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4)__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __[CVE-2023-35943](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq)__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __[CVE-2023-35944](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g)__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.
## Changes

12
content/en/news/security/istio-security-2023-003/index.md
View File

@ -3,8 +3,8 @@ title: ISTIO-SECURITY-2023-003
subtitle: Security Bulletin
description: CVEs reported by Envoy.
cves: [CVE-2023-35941,CVE-2023-35942,CVE-2023-35943,CVE-2023-35944]
cvss: "7.5"
vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
cvss: "8.6"
vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
releases: ["All releases prior to 1.16.0", "1.16.0 to 1.16.6", "1.17.0 to 1.17.4", "1.18.0 to 1.18.1"]
publishdate: 2023-07-25
keywords: [CVE]
@ -17,10 +17,10 @@ skip_seealso: true
### Envoy CVEs
- __CVE-2023-35941__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __CVE-2023-35942__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __CVE-2023-35943__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __CVE-2023-35944__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.
- __[CVE-2023-35941](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7mhv-gr67-hq55)__: (CVSS Score 8.6, High): OAuth2 credentials exploit with permanent validity.
- __[CVE-2023-35942](https://github.com/envoyproxy/envoy/security/advisories/GHSA-69vr-g55c-v2v4)__: (CVSS Score 6.5, Moderate): gRPC access log crash caused by the listener draining.
- __[CVE-2023-35943](https://github.com/envoyproxy/envoy/security/advisories/GHSA-mc6h-6j9x-v3gq)__: (CVSS Score 6.3, Moderate): CORS filter segfault when origin header is removed.
- __[CVE-2023-35944](https://github.com/envoyproxy/envoy/security/advisories/GHSA-pvgm-7jpg-pw5g)__: (CVSS Score 8.2, High): Incorrect handling of HTTP requests and responses with mixed case schemes in Envoy.
## Am I Impacted?