Detections
Analytics

SCA: security update for istio.io/istio (GHSA-7774-7vr3-cc8j)

high Tenable Cloud Security Plugin ID 411888

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Istio is an open source platform for providing a uniform way to integrate microservices, manage traffic
 flow across microservices, enforce policies and aggregate telemetry data. According to [RFC
 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the
 hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case
 sensitive. The proxy will route the request hostname in a case-insensitive way which means the
 authorization policy could be bypassed. As an example, the user may have an authorization policy that
 rejects request with hostname "httpbin.foo" for some source IPs, but the attacker can bypass this by
 sending the request with hostname "Httpbin.Foo". Patches are available in Istio 1.11.1, Istio 1.10.4 and
 Istio 1.9.8. As a work around a Lua filter may be written to normalize Host header before the
 authorization check. This is similar to the Path normalization presented in the [Security Best
 Practices](https://istio.io/latest/docs/ops/best-practices/security/#case-normalization) guide.
 (CVE-2021-39155)

See Also

https://github.com/advisories/GHSA-7774-7vr3-cc8j

Plugin Details

Severity: High

ID: 411888

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-39155

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/30/2021

Vulnerability Publication Date: 8/24/2021

Reference Information

CVE: CVE-2021-39155

cwe: CWE-178