CVE-2022-39388
Istio may allow identity impersonation if user has localhost access
Résumé
Istio may allow identity impersonation if user has localhost access
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web istio.io