Critical severity · published Aug 22, 2022
CVE-2021-3586
A flaw was found in servicemesh-operator
9.8
CVSS
1%
EPSS
No
On KEV
Description
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
Openshift Service Mesh · Redhat
2.0 · source: NVD
SE
Servicemesh-operator · Redhat
2.0.5.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3586
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3586
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1967738
More from Openshift Service Mesh
9.8
CVE-2020-27846
A signature verification vulnerability exists in crewjam/saml
8.8
CVE-2021-3495
An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7
8.6
CVE-2020-1762
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by…
8.6
CVE-2020-1764
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1
8.3
CVE-2019-9900
When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0)