CVE-2022-39388 Istio may allow identity impersonation if user has localhost access
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-39388?
CVE-2022-39388 is a high-severity vulnerability in istio, published on 10 Nov 2022.
Official description
Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.
Weakness: CWE-863
Which versions are affected by CVE-2022-39388?
2 open source packages ship an affected version, including github.com/istio/istio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/istio/istio Go | From 1.15.0-beta.0 | 1.15.3 |
github.com/istio/istio Go | From 1.15.0-beta.0 | 1.15.3 |
Products include Istio Istio.
How do I fix CVE-2022-39388?
Upgrade github.com/istio/istio to 1.15.3 or later.
Is CVE-2022-39388 being exploited?
There is no known exploitation of CVE-2022-39388 in the wild and no public exploit code.
Other vulnerabilities in istio
- CVE-2021-31921 Missing authorization in n/a
- CVE-2021-34824 Information disclosure in n/a
- CVE-2026-31837 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
- CVE-2021-39155 Authorization Policy Bypass Due to Case Insensitive Host Comparison
- CVE-2021-39156 Fragments in Path May Lead to Authorization Policy Bypass
Sources
Also known as GHSA-6c6p-h79f-g6p4.