{"id":"RHSA-2022:1276","summary":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.9 security update","modified":"2026-04-07T10:01:32Z","published":"2024-09-30T14:20:27Z","upstream":["CVE-2020-28851","CVE-2020-28852","CVE-2021-29482","CVE-2021-29923","CVE-2021-3121","CVE-2021-36221","CVE-2021-3749","CVE-2021-43565","CVE-2021-43824","CVE-2021-43825","CVE-2021-43826","CVE-2022-21654","CVE-2022-21655","CVE-2022-23606","CVE-2022-23635","CVE-2022-24726"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2022:1276"},{"type":"ARTICLE","url":"https://access.redhat.com/security/updates/classification/#important"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913333"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1913338"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921650"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954368"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992006"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995656"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999784"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030787"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050744"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050746"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050748"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050753"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050757"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2050758"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2057277"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2061638"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1276.json"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2020-28851"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2020-28851"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28851"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2020-28852"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2020-28852"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28852"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-3121"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-3121"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3121"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-3749"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-3749"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3749"},{"type":"ARTICLE","url":"https://github.com/axios/axios/commit/5b457116e31db0e88fede6c428e969e87f290929"},{"type":"ARTICLE","url":"https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-29482"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-29482"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29482"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-29923"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-29923"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29923"},{"type":"ARTICLE","url":"https://sick.codes/sick-2021-016/"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-36221"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-36221"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36221"},{"type":"ARTICLE","url":"https://groups.google.com/g/golang-announce/c/uHACNfXAZqk"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-43565"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-43565"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43565"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-43824"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-43824"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43824"},{"type":"ARTICLE","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-43825"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-43825"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43825"},{"type":"ARTICLE","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2021-43826"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2021-43826"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43826"},{"type":"ARTICLE","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2022-21654"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2022-21654"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21654"},{"type":"ARTICLE","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2022-21655"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2022-21655"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21655"},{"type":"ARTICLE","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2022-23606"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2022-23606"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23606"},{"type":"ARTICLE","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxf"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2022-23635"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2022-23635"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23635"},{"type":"ARTICLE","url":"https://istio.io/latest/news/security/istio-security-2022-003"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2022-24726"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2022-24726"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24726"},{"type":"ARTICLE","url":"https://istio.io/latest/news/security/istio-security-2022-004/"}],"affected":[{"package":{"name":"servicemesh","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-istioctl","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-istioctl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-mixc","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-mixc"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-mixs","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-mixs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-pilot-agent","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-pilot-agent"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-pilot-discovery","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-pilot-discovery"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"kiali","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/kiali"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.24.7.redhat1-1.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-prometheus","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-prometheus"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.0-16.el8.1"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}},{"package":{"name":"servicemesh-proxy","ecosystem":"Red Hat:service_mesh:2.0::el8","purl":"pkg:rpm/redhat/servicemesh-proxy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-3.el8"}]}],"database_specific":{"source":"https://security.access.redhat.com/data/osv/RHSA-2022:1276.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"}]}