VDB
RHSA-2023%3A4625
RHSA-2023%3A4625
PUBLISHED
CVSS 8.600000381469727 HIGH
A flaw was found in Envoy, where a malicious client can construct credentials with permanent validity in a specific scenario. This issue is caused by some rare scenarios, such as the combination of host and expiration time, in which the HMAC payload can always be valid in the OAuth2 filter's HMAC check.
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:46abe1e995f4796110c358744084f797a98e9f37258b506fe3406dd213cb6578_amd64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:46abe1e995f4796110c358744084f797a98e9f37258b506fe3406dd213cb6578_amd64 |
| Red Hat | openshift-service-mesh/istio-must-gather-rhel8@sha256:77bfc5c77e343fbeae3e19d390f8598e5f69661fb54c2ced8c0c49eb4d993308_arm64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-must-gather-rhel8@sha256:77bfc5c77e343fbeae3e19d390f8598e5f69661fb54c2ced8c0c49eb4d993308_arm64 |
| Red Hat | openshift-service-mesh/ratelimit-rhel8@sha256:dd6b2b1f8b90238b885953e22c01bfc62d3243cc8b501c86b40a892e774f2c7a_ppc64le as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/ratelimit-rhel8@sha256:dd6b2b1f8b90238b885953e22c01bfc62d3243cc8b501c86b40a892e774f2c7a_ppc64le |
| Red Hat | openshift-service-mesh/istio-rhel8-operator@sha256:0ed49691c656ab9916b81a308ed942377760d4019bb2465735b5071c659070f3_amd64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-rhel8-operator@sha256:0ed49691c656ab9916b81a308ed942377760d4019bb2465735b5071c659070f3_amd64 |
| Red Hat | openshift-service-mesh/proxyv2-rhel8@sha256:28d3f0e2bfa0f6cc04275f2cfab1427e2903a403550e5ccf4cc192ab86e784d6_ppc64le as a component of RHOSSM 2.4 for RHEL 8 | * |
| Red Hat | openshift-service-mesh/grafana-rhel8@sha256:562b81ae1d60684dcbd7af1642382e88920a13165a348b6b8cc14f0a89c16321_s390x as a component of RHOSSM 2.4 for RHEL 8 | * |
| Red Hat | openshift-service-mesh/ratelimit-rhel8@sha256:99f2890cca37225e318ef39d50800ace6e889c7e59d343a92d4343f4fec8d150_s390x as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/ratelimit-rhel8@sha256:99f2890cca37225e318ef39d50800ace6e889c7e59d343a92d4343f4fec8d150_s390x |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:e2d0c6c599336b7db5b7c90e1490d73c029fae204dc086978bb07b0f8d312d06_s390x as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:e2d0c6c599336b7db5b7c90e1490d73c029fae204dc086978bb07b0f8d312d06_s390x |
| Red Hat | openshift-service-mesh/istio-rhel8-operator@sha256:8e01420f8a1f0fd72461dd8c377c29c086e4616826bfc128915ff0d468758c18_ppc64le as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-rhel8-operator@sha256:8e01420f8a1f0fd72461dd8c377c29c086e4616826bfc128915ff0d468758c18_ppc64le |
| Red Hat | openshift-service-mesh/istio-must-gather-rhel8@sha256:2bb07daadf9c7836a02252e7bc42eba1f43563ed6fcc5ec7c59eb6f9719874db_s390x as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-must-gather-rhel8@sha256:2bb07daadf9c7836a02252e7bc42eba1f43563ed6fcc5ec7c59eb6f9719874db_s390x |
| Red Hat | openshift-service-mesh/ratelimit-rhel8@sha256:1fce10dd8e3903b5391e0176dc1c4f23113d274f68567a3161d9696b1b858ce6_amd64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/ratelimit-rhel8@sha256:1fce10dd8e3903b5391e0176dc1c4f23113d274f68567a3161d9696b1b858ce6_amd64 |
| Red Hat | openshift-service-mesh/istio-must-gather-rhel8@sha256:b54fd04a30412ca92b046728f8ec513237235b18072a4cc7b241ef2586a2145c_ppc64le as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-must-gather-rhel8@sha256:b54fd04a30412ca92b046728f8ec513237235b18072a4cc7b241ef2586a2145c_ppc64le |
| Red Hat | openshift-service-mesh/pilot-rhel8@sha256:ab76505430875f6895fe269156bfefb79e6c08226e8205941760133230a11993_ppc64le as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/pilot-rhel8@sha256:ab76505430875f6895fe269156bfefb79e6c08226e8205941760133230a11993_ppc64le |
| Red Hat | openshift-service-mesh/istio-must-gather-rhel8@sha256:8ec88c4a8e3df430fafa5b5b3e623ed111ce1456539bedf29a791995a548c03e_amd64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-must-gather-rhel8@sha256:8ec88c4a8e3df430fafa5b5b3e623ed111ce1456539bedf29a791995a548c03e_amd64 |
| Red Hat | openshift-service-mesh/istio-cni-rhel8@sha256:4c7f85a069b9c50e5ed5c7eb9f5bf453bca43156564878c33092cdc45a1500d2_ppc64le as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/istio-cni-rhel8@sha256:4c7f85a069b9c50e5ed5c7eb9f5bf453bca43156564878c33092cdc45a1500d2_ppc64le |
| Red Hat | openshift-service-mesh/pilot-rhel8@sha256:45e7246f67faeefb0b52d789c33e4fd61694a27611e3d98a143f8c0a5c72bb7a_amd64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/pilot-rhel8@sha256:45e7246f67faeefb0b52d789c33e4fd61694a27611e3d98a143f8c0a5c72bb7a_amd64 |
| Red Hat | openshift-service-mesh/pilot-rhel8@sha256:b67fdd91fccee205e74d4fe47aece9ba78f0dee04635dd83f5edcb984e94ad50_s390x as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/pilot-rhel8@sha256:b67fdd91fccee205e74d4fe47aece9ba78f0dee04635dd83f5edcb984e94ad50_s390x |
| Red Hat | openshift-service-mesh/istio-rhel8-operator@sha256:67227db1a9ccc2b81938f91959df0bba8791010429e619dd39b1f85e4c6cb832_s390x as a component of RHOSSM 2.4 for RHEL 8 | * |
| Red Hat | openshift-service-mesh/grafana-rhel8@sha256:71e3d3cf8e1a5812365695e9f7747a0f86e281b543c3e3a91ea655796a31fa51_amd64 as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/grafana-rhel8@sha256:71e3d3cf8e1a5812365695e9f7747a0f86e281b543c3e3a91ea655796a31fa51_amd64 |
| Red Hat | openshift-service-mesh/proxyv2-rhel8@sha256:ff9b876604bf6b157e7ba007c9b8569140ba2bc3cac0e9bc928392bfa58558a4_s390x as a component of RHOSSM 2.4 for RHEL 8 | openshift-service-mesh/proxyv2-rhel8@sha256:ff9b876604bf6b157e7ba007c9b8569140ba2bc3cac0e9bc928392bfa58558a4_s390x |
…and 2 more
Timeline
- Aug 11, 2023 CVE Published
- Mar 18, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:4625 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2217977 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2217985 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2217987 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4625.json advisory
- https://access.redhat.com/security/cve/CVE-2023-35941 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-35941 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-35941 advisory
- https://access.redhat.com/security/cve/CVE-2023-35943 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-35943 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-35943 advisory
- https://access.redhat.com/security/cve/CVE-2023-35944 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-35944 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-35944 advisory
- https://access.redhat.com/security/cve/CVE-2023-35945 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2217983 issue
- https://www.cve.org/CVERecord?id=CVE-2023-35945 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-35945 advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r advisory