Multiple vulnerabilities in Istio
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2023-35941 CVE-2023-35942 CVE-2023-35943 CVE-2023-35944 |
| CWE-ID | CWE-116 CWE-416 CWE-20 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #4 is available. |
| Vulnerable software Subscribe |
Istio Web applications / Other software |
| Vendor | Istio |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Improper Encoding or Escaping of Output
EUVDB-ID: #VU78678
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C]
CVE-ID: CVE-2023-35941
CWE-ID:
CWE-116 - Improper Encoding or Escaping of Output
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper encoding or escaping of output. A remote attacker can construct credentials with permanent validity.
MitigationInstall update from vendor's website.
Vulnerable software versionsIstio: 0.1 - 1.18.1
External linkshttp://istio.io/latest/news/security/istio-security-2023-003
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Use-after-free
EUVDB-ID: #VU78682
Risk: Medium
CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2023-35942
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the gRPC access logger extension. A remote user can perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsIstio: 0.1 - 1.18.1
External linkshttp://istio.io/latest/news/security/istio-security-2023-003
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
3) Use-after-free
EUVDB-ID: #VU78681
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2023-35943
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the HTTP CORS filter. A remote user can perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsIstio: 0.1 - 1.18.1
External linkshttp://istio.io/latest/news/security/istio-security-2023-003
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
4) Input validation error
EUVDB-ID: #VU78679
Risk: High
CVSSv3.1: 7.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2023-35944
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect handling of requests and responses with mixed case schemes. A remote attacker can pass specially crafted input to the application and bypass some requests with mixed schemes.
MitigationInstall update from vendor's website.
Vulnerable software versionsIstio: 0.1 - 1.18.1
External linkshttp://istio.io/latest/news/security/istio-security-2023-003
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
