SB2021062502 - Security restrictions bypass in Istio

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021062502

SB2021062502 - Security restrictions bypass in Istio

Published: June 25, 2021

Security Bulletin ID SB2021062502
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Security restrictions bypass (CVE-ID: CVE-2021-34824)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to application does not properly impose security restrictions.

The Istio Gateway and DestinationRule can load private keys and certificates from Kubernetes secrets via the credentialName configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API.

In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod.


Remediation

Install update from vendor's website.

References