Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1. Users are advised to upgrade. There are no known workarounds for this issue.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9772 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9774 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9773 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9771 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5004 advisory.

  - golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString     (CVE-2022-23772)

  - golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)

  - golang: crypto/elliptic: IsOnCurve returns true for invalid field elements (CVE-2022-23806)

  - envoy: Segfault in GrpcHealthCheckerImpl (CVE-2022-29224)

  - envoy: Decompressors can be zip bombed (CVE-2022-29225)

  - envoy: oauth filter allows trivial bypass (CVE-2022-29226)

  - envoy: oauth filter calls continueDecoding() from within decodeHeaders() (CVE-2022-29228)

  - Istio: Unsafe memory access in metadata exchange. (CVE-2022-31045)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9588 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate     decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This     may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload.
    Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are     advised to upgrade. Users unable to upgrade may consider disabling decompression. (CVE-2022-29225)

  - Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a     segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health     checking. One of them uses gRPC. Envoy also has a feature which can hold? (prevent removal) upstream     hosts obtained via service discovery until configured active health checking fails. If an attacker     controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.),     an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the     gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to     upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or     replace it with a different health checking type as a mitigation. (CVE-2022-29224)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to     invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in     newer versions and corrupts memory on earlier versions. continueDecoding() shouldnt ever be called from     filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds     for this issue. (CVE-2022-29228)

  - Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy     attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, theres a     lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the     redirect headers are processed, the downstream state indicates that the downstream stream is not complete.
    On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually     complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to     upgrade are advised to disable internal redirects if crashes are observed. (CVE-2022-29227)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter     implementation does not include a mechanism for validating access tokens, so by design when the HMAC     signed cookie is missing a full authentication flow should be triggered. However, the current     implementation assumes that access tokens are always validated thus allowing access in the presence of any     access token attached to the request. Users are advised to upgrade. There is no known workaround for this     issue. (CVE-2022-29226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9589 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate     decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This     may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload.
    Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are     advised to upgrade. Users unable to upgrade may consider disabling decompression. (CVE-2022-29225)

  - Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a     segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health     checking. One of them uses gRPC. Envoy also has a feature which can hold? (prevent removal) upstream     hosts obtained via service discovery until configured active health checking fails. If an attacker     controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.),     an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the     gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to     upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or     replace it with a different health checking type as a mitigation. (CVE-2022-29224)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to     invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in     newer versions and corrupts memory on earlier versions. continueDecoding() shouldnt ever be called from     filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds     for this issue. (CVE-2022-29228)

  - Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy     attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, theres a     lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the     redirect headers are processed, the downstream state indicates that the downstream stream is not complete.
    On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually     complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to     upgrade are advised to disable internal redirects if crashes are observed. (CVE-2022-29227)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter     implementation does not include a mechanism for validating access tokens, so by design when the HMAC     signed cookie is missing a full authentication flow should be triggered. However, the current     implementation assumes that access tokens are always validated thus allowing access in the presence of any     access token attached to the request. Users are advised to upgrade. There is no known workaround for this     issue. (CVE-2022-29226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9587 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate     decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This     may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload.
    Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are     advised to upgrade. Users unable to upgrade may consider disabling decompression. (CVE-2022-29225)

  - Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a     segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health     checking. One of them uses gRPC. Envoy also has a feature which can hold? (prevent removal) upstream     hosts obtained via service discovery until configured active health checking fails. If an attacker     controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.),     an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the     gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to     upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or     replace it with a different health checking type as a mitigation. (CVE-2022-29224)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to     invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in     newer versions and corrupts memory on earlier versions. continueDecoding() shouldnt ever be called from     filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds     for this issue. (CVE-2022-29228)

  - Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy     attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, theres a     lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the     redirect headers are processed, the downstream state indicates that the downstream stream is not complete.
    On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually     complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to     upgrade are advised to disable internal redirects if crashes are observed. (CVE-2022-29227)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter     implementation does not include a mechanism for validating access tokens, so by design when the HMAC     signed cookie is missing a full authentication flow should be triggered. However, the current     implementation assumes that access tokens are always validated thus allowing access in the presence of any     access token attached to the request. Users are advised to upgrade. There is no known workaround for this     issue. (CVE-2022-29226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9586 advisory.

  - Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed     headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in     undefined behavior or crashing. Users are most likely at risk if they have an Istio ingress Gateway     exposed to external traffic. This vulnerability has been resolved in versions 1.12.8, 1.13.5, and 1.14.1.
    Users are advised to upgrade. There are no known workarounds for this issue. (CVE-2022-31045)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 secompressors accumulate     decompressed data into an intermediate buffer before overwriting the body in the decode/encodeBody. This     may allow an attacker to zip bomb the decompressor by sending a small highly compressed payload.
    Maliciously constructed zip files may exhaust system memory and cause a denial of service. Users are     advised to upgrade. Users unable to upgrade may consider disabling decompression. (CVE-2022-29225)

  - Envoy is a cloud-native high-performance proxy. Versions of envoy prior to 1.22.1 are subject to a     segmentation fault in the GrpcHealthCheckerImpl. Envoy can perform various types of upstream health     checking. One of them uses gRPC. Envoy also has a feature which can hold? (prevent removal) upstream     hosts obtained via service discovery until configured active health checking fails. If an attacker     controls an upstream host and also controls service discovery of that host (via DNS, the EDS API, etc.),     an attacker can crash Envoy by forcing removal of the host from service discovery, and then failing the     gRPC health check request. This will crash Envoy via a null pointer dereference. Users are advised to     upgrade to resolve this vulnerability. Users unable to upgrade may disable gRPC health checking and/or     replace it with a different health checking type as a mitigation. (CVE-2022-29224)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter would try to     invoke the remaining filters in the chain after emitting a local response, which triggers an ASSERT() in     newer versions and corrupts memory on earlier versions. continueDecoding() shouldnt ever be called from     filters after a local reply has been sent. Users are advised to upgrade. There are no known workarounds     for this issue. (CVE-2022-29228)

  - Envoy is a cloud-native high-performance edge/middle/service proxy. In versions prior to 1.22.1 if Envoy     attempts to send an internal redirect of an HTTP request consisting of more than HTTP headers, theres a     lifetime bug which can be triggered. If while replaying the request Envoy sends a local reply when the     redirect headers are processed, the downstream state indicates that the downstream stream is not complete.
    On sending the local reply, Envoy will attempt to reset the upstream stream, but as it is actually     complete, and deleted, this result in a use-after-free. Users are advised to upgrade. Users unable to     upgrade are advised to disable internal redirects if crashes are observed. (CVE-2022-29227)

  - Envoy is a cloud-native high-performance proxy. In versions prior to 1.22.1 the OAuth filter     implementation does not include a mechanism for validating access tokens, so by design when the HMAC     signed cookie is missing a full authentication flow should be triggered. However, the current     implementation assumes that access tokens are always validated thus allowing access in the presence of any     access token attached to the request. Users are advised to upgrade. There is no known workaround for this     issue. (CVE-2022-29226)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
164895	Oracle Linux 7 : istio (ELSA-2022-9772)	Nessus	Oracle Linux Local Security Checks	critical
164894	Oracle Linux 7 : istio (ELSA-2022-9774)	Nessus	Oracle Linux Local Security Checks	critical
164893	Oracle Linux 8 : istio (ELSA-2022-9773)	Nessus	Oracle Linux Local Security Checks	critical
164892	Oracle Linux 8 : istio (ELSA-2022-9771)	Nessus	Oracle Linux Local Security Checks	critical
164877	RHEL 8 : Red Hat OpenShift Service Mesh 2.1.3 (RHSA-2022:5004)	Nessus	Red Hat Local Security Checks	critical
163039	Oracle Linux 8 : olcne (ELSA-2022-9588)	Nessus	Oracle Linux Local Security Checks	critical
163038	Oracle Linux 7 : olcne (ELSA-2022-9589)	Nessus	Oracle Linux Local Security Checks	critical
163013	Oracle Linux 7 : olcne (ELSA-2022-9587)	Nessus	Oracle Linux Local Security Checks	critical
163011	Oracle Linux 8 : olcne (ELSA-2022-9586)	Nessus	Oracle Linux Local Security Checks	critical

Detections

Analytics

CVE-2022-31045

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical