CVE-2021-3586 Misconfiguration in servicemesh-operator

Critical 9.8 Published 22 Aug 2022 Updated 3 Aug 2024

Improper NetworkPolicy configuration in servicemesh-operator allows unrestricted pod-to-pod access, compromising data confidentiality, integrity, and availability.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-3586?

CVE-2021-3586 is a critical vulnerability in servicemesh-operator, published on 22 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Weakness: CWE-1188

Which versions are affected by CVE-2021-3586?

It affects 2 products.

Linux distribution packages (1)

servicemesh-operator Red Hat:service_mesh:2.0::el8 All versions 0:2.0.5-3.el8

Products include Redhat Openshift Service Mesh, Redhat Servicemesh-Operator.

How do I fix CVE-2021-3586?

Apply the vendor's patch.

Is CVE-2021-3586 being exploited?

There is no known exploitation of CVE-2021-3586 in the wild and no public exploit code.

Sources

Also known as GHSA-hq9j-p426-983m, RHSA-2021:2380.