Reasons to update Istio: CVEs fixed since 1.9.0

[davidspek]

A list of security vulnerabilities that highlight the necessity to keep Istio up to date.

1.9.1:
A zero-day security vulnerability was fixed in the version of Envoy shipped with Istio 1.9.0. This vulnerability was fixed on February 26th, 2021.

1.9.3:
Fixes the security vulnerabilities described in their blog post

• CVE-2021-28683: Envoy contains a remotely exploitable NULL pointer dereference and crash in TLS when an unknown TLS alert code is received.
  • CVSS Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• CVE-2021-28682: Envoy contains a remotely exploitable integer overflow in which a very large grpc-timeout value leads to unexpected timeout calculations.
  • CVSS Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• CVE-2021-29258: Envoy contains a remotely exploitable vulnerability where an HTTP2 request with an empty metadata map can cause Envoy to crash.
  • CVSS Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

1.9.5:
Fixes the security vulnerabilities described in the blog posts ISTIO-SECURITY-2021-005 and ISTIO-SECURITY-2021-006

• CVE-2021-31920: Istio contains a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used. See the ISTIO-SECURITY-2021-005 bulletin for more details.
  • CVSS Score: 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• CVE-2021-29492: Envoy contains a remotely exploitable vulnerability where an HTTP request with escaped slash characters can bypass Envoy’s authorization mechanisms.
  • CVSS Score: 8.3 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
• CVE-2021-31921: Istio contains a remotely exploitable vulnerability where an external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration. See the ISTIO-SECURITY-2021-006 bulletin for more details.
  • CVSS Score: 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

/cc @yanniszark

[juliusvonkohout]

Just for the sake of documentation again

If you upgrade istio please consider switching from the ratelimited dockerhub to the official istio gcr repository. Especially for the cluster-local-gateway

manifests/common/istio-1-9-0/cluster-local-gateway/base/cluster-local-gateway.yaml

Line 154 in 3eab165

image: docker.io/istio/proxyv2:1.9.0

istioctl manifest generate --set hub='gcr.io/istio-release'
# --set values.global.proxy.resources.requests.cpu=10m might also be interesting

I am using this with more parameters (e.g. --set tag='1.9.2') for Minikube and Openshift.

We could also consider CNI profiles. I have working CNI profiles for minikube and openshift that remove the need for istio-init root containers https://istio.io/latest/docs/setup/additional-setup/cni/