Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/istio/istio/security: CVE-2022-39388 #1103

Closed
GoVulnBot opened this issue Nov 10, 2022 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/istio/istio/security: CVE-2022-39388 #1103

GoVulnBot opened this issue Nov 10, 2022 · 3 comments
Assignees
@zpavlinovic
Labels
duplicate

Comments

@GoVulnBot
Copy link

CVE-2022-39388 references github.com/istio/istio/security, which may be a Go module.

Description:
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

References:

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/istio/istio/security
    packages:
      - package: istio
description: |
    Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
cves:
  - CVE-2022-39388
references:
  - web: https://github.com/istio/istio/security/advisories/GHSA-6c6p-h79f-g6p4
  - fix: https://github.com/istio/istio/commit/346260e5115e9fbc65ba8a559bc686e6ca046a32
  - fix: https://github.com/istio/istio/commit/9a643e270421560afb2630e00f76d46a55499df9
  - web: https://istio.io/latest/news/releases/1.15.x/announcing-1.15.3/
@zpavlinovic zpavlinovic self-assigned this Nov 10, 2022
@zpavlinovic zpavlinovic added the excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. label Nov 10, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/449715 mentions this issue: data/excluded: add GO-2022-1103.yaml

@tatianab
Copy link
Contributor

Duplicate of #1101

@tatianab tatianab marked this as a duplicate of #1101 Nov 18, 2022
@tatianab tatianab added duplicate and removed excluded: NOT_IMPORTABLE This vulnerability only exists in a binary and is not importable. labels Nov 18, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/451279 mentions this issue: data/excluded: delete duplicate GO-2022-1103

gopherbot pushed a commit that referenced this issue Nov 18, 2022
@tatianab
data/excluded: delete duplicate GO-2022-1103
d524846 
Duplicate of GO-2022-1101

For #1103, #1101

Change-Id: Ib7bb56af9e294241300cc16672f462f027d71b11
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/451279
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Tatiana Bradley <tatiana@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zpavlinovic zpavlinovic

Labels
duplicate
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@zpavlinovic @tatianab @gopherbot @GoVulnBot