Impact client 1.1.95/10/2023 In this case, Kubernetes will redeploy the pod, including the workload behind Envoy. pilot-agent will stop restarting Envoy after it crashed more than ten times. The pilot-agent will restart the crashed Envoy automatically and it may take a few seconds to a few minutes for the restart. When Envoy crashes, all existing connections will be disconnected immediately. For example, the Istio ingress gateway might forward the JWT token to the sidecar which could be a malformed JWT token that crashes the sidecar.Ī vulnerable Envoy will crash on an HTTP request with a malformed JWT token. If JWT policy is applied to the sidecar only, please keep in mind it might still be vulnerable. If JWT policy is applied to the Istio ingress gateway, please be aware that any external user who has access to the ingress gateway could crash it with a single HTTP request. This CVE is triggered only when using this algorithm but is unrelated to the security of the system. The RSA algorithm used for signature verification does not contain any known security vulnerability. The JWT issuer (specified by jwksUri) uses the RSA algorithm for signature verification.A JWT authentication policy is applied to it.Impact and detectionĮnvoy is vulnerable if the following two conditions are satisfied: Thus, this bug makes Envoy vulnerable to a potential DoS attack. The Envoy crash can be triggered using a malformed JWT without a valid signature, and on any URI being accessed regardless of the trigger_rules in the JWT specification. The symptoms of the bug are an HTTP 503 error seen by the client, and Epoch 0 terminated with an error: signal: segmentation fault (core dumped) ![]() ![]() This bug affects all versions of Istio that are using the JWT authentication policy. The bug was discovered and reported by a user on GitHub on June 23, 2019. 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:CĪ bug in Istio’s JWT validation filter causes Envoy to crash in certain cases when the request contains a malformed JWT token.
0 Comments
Leave a Reply. |