1.31.0-alpha.0 Wed, Jul 22
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.31.0-alpha.0/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.31.0-alpha.0/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.29.6/) [Release Notes](https://istio.io/news/releases/1.29.x/announcing-1.29.6/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.30.3/) [Release Notes](https://istio.io/news/releases/1.30.x/announcing-1.30.3/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.28.10/) [Release Notes](https://istio.io/news/releases/1.28.x/announcing-1.28.10/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.28.9/) [Release Notes](https://istio.io/news/releases/1.28.x/announcing-1.28.9/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.29.5/) [Release Notes](https://istio.io/news/releases/1.29.x/announcing-1.29.5/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.30.2/) [Release Notes](https://istio.io/news/releases/1.30.x/announcing-1.30.2/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.29.4/) [Release Notes](https://istio.io/news/releases/1.29.x/announcing-1.29.4/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.28.8/) [Release Notes](https://istio.io/news/releases/1.28.x/announcing-1.28.8/)
[Artifacts](http://gcsweb.istio.io/gcs/istio-release/releases/1.30.1/) [Release Notes](https://istio.io/news/releases/1.30.x/announcing-1.30.1/)
### Impact When a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS configuration. Note: a partial mitigation for this was released in 1.29.1, 128.5, and 1.27.8; however, it was incomplete and missed a few codepaths. 1.29.2 and 1.28.6 contain the more robust fix.
### Impact The `serviceAccounts` and `notServiceAccounts` fields in AuthorizationPolicy incorrectly interpret dots (`.`) as a regular expression matcher. Because `.` is a valid character in a service account name, an `AuthorizationPolicy` ALLOW rule targeting SA e.g. `cert-manager.io` also matches `cert-manager-io`, `cert-managerXio`, etc. A DENY rule targeting the same name fails to block those variants. ### Patches Fixes are available in 1.29.2, 1.28.6, and 1.27.9 ### Workarounds None
### Impact Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing. You are at most risk if you have an Istio ingress Gateway exposed to external traffic. ### Patches 1.12.8, 1.13.5, 1.14.1 ### Workarounds No.
Istio 1.3.x before 1.3.5 is vulnerable to denial of service because `continue_on_listener_filters_timeout` is set to True, a related issue to CVE-2019-18836.
Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
### Impact The Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius.
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy. ### Specific Go Packages Affected istio.io/istio/pilot/pkg/security/authz/model/matcher
Istio 1.1.x through 1.1.6 has Incorrect Access Control. When `disablePolicyChecks` is set to `false`, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied. This behavior is a result of a change to `istio/pilot/pkg/networking/plugin/mixer/mixer.go` in 1.1.
### Impact Istio 1.11.0, 1.10.3 and below, and 1.9.7 and below contain a remotely exploitable vulnerability where an HTTP request with `#fragment` in the path may bypass Istio’s URI path based authorization policies. ### Patches * Istio 1.11.1 and above * Istio 1.10.4 and above * Istio 1.9.8 and above ### Workarounds A Lua filter may be written to normalize the path.
### Impact According to [RFC 4343](https://datatracker.ietf.org/doc/html/rfc4343), Istio authorization policy should compare the hostname in the HTTP Host header in a case insensitive way, but currently the comparison is case sensitive. The Envoy proxy will route the request hostname in a case-insensitive way which means the authorization policy could be bypassed.