Istio may not check inbound TCP connections against istio-policy

GHSA-6g5f-f5pm-mjrg · CVE-2019-12243

Published Feb 15, 2022 · Modified Nov 8, 2023

Description

Istio 1.1.x through 1.1.6 has Incorrect Access Control. When disablePolicyChecks is set to false, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.

This behavior is a result of a change to istio/pilot/pkg/networking/plugin/mixer/mixer.go in 1.1.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-12243
WEB https://github.com/istio/istio/issues/13868
WEB https://github.com/istio/istio/pull/13893/commits/91faba277439dab798185730d1624bd53e37bb06
WEB https://istio.io/blog/2019/cve-2019-12243

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes