istio istio 授权机制不正确

CVE编号

CVE-2021-39156

利用情况

暂无

补丁情况

N/A

披露时间

2021-08-25

漏洞描述

Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic flow across microservices, enforce policies and aggregate telemetry data. Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. Patches are available in Istio 1.11.1, Istio 1.10.4 and Istio 1.9.8. As a work around a Lua filter may be written to normalize the path.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/istio/istio/security/advisories/GHSA-hqxw-mm44-gc4r
https://istio.io/latest/news/security/istio-security-2021-008

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	istio	istio	*		Up to (excluding) 1.9.8
	运行在以下环境
	应用	istio	istio	*	From (including) 1.10.0	Up to (excluding) 1.10.3
	运行在以下环境
	应用	istio	istio	*	From (including) 1.11.0	Up to (excluding) 1.11.1

CVSS3评分 8.1

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 未更改
• 用户交互 需要
• 可用性 无
• 保密性 高
• 完整性 高

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CWE-ID 漏洞类型 CWE-863 授权机制不正确