istio.io/content/en/news/security/istio-security-2019-006/index.md

title	subtitle	description	cves	cvss	vector	releases	publishdate	keywords	skip_seealso	aliases
ISTIO-SECURITY-2019-006	Security Bulletin	Denial of service.	CVE-2019-18817	7.5	AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C	1.3 to 1.3.4	2019-11-07	CVE	true	/news/2019/istio-security-2019-006

{{< security_bulletin >}}

Envoy, and subsequently Istio, are vulnerable to the following DoS attack. An infinite loop can be triggered in Envoy if the option continue_on_listener_filters_timeout is set to True. This has been the case for Istio since the introduction of the Protocol Detection feature in Istio 1.3 A remote attacker may trivially trigger that vulnerability, effectively exhausting Envoy’s CPU resources and causing a denial-of-service attack.

Impact and detection

Both Istio gateways and sidecars are vulnerable to this issue. If you are running one of the affected releases, your cluster is vulnerable.

Mitigation

• Workaround: The exploitation of that vulnerability can be prevented by customizing Istio installation (as described in installation options ), using Helm to override the following options:

  {{< text plain >}} --set pilot.env.PILOT_INBOUND_PROTOCOL_DETECTION_TIMEOUT=0s --set global.proxy.protocolDetectionTimeout=0s {{< /text >}}

• For Istio 1.3.x deployments: update to Istio 1.3.5 or later.

{{< boilerplate "security-vulnerability" >}}