FS#70808 : [istio] [Security] multiple issues (AVG-1947)

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#70808 - [istio] [Security] multiple issues (AVG-1947)

Attached to Project: Community Packages
Opened by Jonas Witschel (diabonas) - Wednesday, 12 May 2021, 07:55 GMT
Last edited by Jonas Witschel (diabonas) - Tuesday, 01 June 2021, 19:49 GMT

Task Type	Bug Report
Category	Security
Status	Closed
Assigned To	Christian Rebischke (Shibumi) Levente Polyak (anthraxx)
Architecture	All
Severity	High
Priority	Normal
Reported Version
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	0
Private	No

Details

Summary
=======

The package istio is vulnerable to multiple issues including authentication bypass, arbitrary code execution and denial of service via CVE-2021-31921, CVE-2021-31920, CVE-2021-29492, CVE-2021-29258, CVE-2021-28683 and CVE-2021-28682.

Guidance
========

Upgrading Istio to the latest version 1.9.5 (https://github.com/istio/istio/releases/tag/1.9.5) fixes the issues.

References
==========

https://security.archlinux.org/AVG-1947
https://istio.io/latest/news/security/istio-security-2021-006/
https://github.com/istio/istio/commit/04d2c8b72be1d9ebae5d6e06c41ba2ae3d3d54b4
https://istio.io/latest/news/security/istio-security-2021-005/
https://github.com/istio/istio/commit/749b8f8e15ebd4ab890373bc976e68ae100345df
https://istio.io/latest/news/releases/1.9.x/announcing-1.9.5/
https://bugzilla.redhat.com/show_bug.cgi?id=1951188
https://github.com/envoyproxy/envoy/commit/b7d7c09cd4c542f6961ddae2273e9232483c29b7
https://istio.io/latest/news/security/istio-security-2021-003/
https://github.com/envoyproxy/envoy/commit/e7c114224f75571fc64542c4e641a73768e2df71
https://github.com/envoyproxy/envoy/commit/35783a5559f5e883533fdbe7b913dd63d4dc772e
https://github.com/envoyproxy/envoy/commit/e383908bf29ce78d196b2f6cd4f41e7862acf6e8

This task depends upon

Closed by Jonas Witschel (diabonas)
Tuesday, 01 June 2021, 19:49 GMT
Reason for closing: Fixed
Additional comments about closing: istio 1.10.0-1

Comments (0)
Related Tasks (0/0)

	Tasks related to this task (0)

Duplicate tasks of this task (0)

Arch Linux

Community Packages

FS#70808 - [istio] [Security] multiple issues (AVG-1947)

Details

Loading...