CRITICAL9.3

GHSA-6g5f-f5pm-mjrg

Istio may not check inbound TCP connections against istio-policy

Quick fix

GHSA-6g5f-f5pm-mjrg — istio.io/istio: upgrade to the fixed version with the command below.

go get istio.io/istio@v1.1.7

Details

Istio 1.1.x through 1.1.6 has Incorrect Access Control. When `disablePolicyChecks` is set to `false`, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.

This behavior is a result of a change to `istio/pilot/pkg/networking/plugin/mixer/mixer.go` in 1.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/istio.io/istio

Introduced in: 1.1.0Fixed in: 1.1.7

Fixgo get istio.io/istio@v1.1.7

References

https://nvd.nist.gov/vuln/detail/CVE-2019-12243[ADVISORY]
https://github.com/istio/istio/issues/13868[WEB]
https://github.com/istio/istio/pull/13893/commits/91faba277439dab798185730d1624bd53e37bb06[WEB]
https://istio.io/blog/2019/cve-2019-12243[WEB]