SB2022022247 - Improper handling of exceptional conditions in Istio
Published: February 22, 2022 Updated: April 20, 2026
Security Bulletin ID
SB2022022247
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper handling of exceptional conditions (CVE-ID: CVE-2022-23635)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a request processing error in the istiod control plane when handling a specially crafted message on port 15012. A remote attacker can send a specially crafted message to cause a denial of service.
In simple installations, the vulnerable endpoint is typically reachable only from within the cluster, but it may be exposed over the public internet in some multicluster deployments.
Remediation
Install update from vendor's website.