Resource Exhaustion Affecting olcne-oci-ccm-chart package, versions <0:1.5.10-2.el8


Severity

Recommended
0.0
high
0
10

Based on Oracle Linux security rating

    Threat Intelligence

    EPSS
    0.21% (60th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ORACLE8-OLCNEOCICCMCHART-5673130
  • published 9 Jun 2023
  • disclosed 13 Oct 2022

How to fix?

Upgrade Oracle:8 olcne-oci-ccm-chart to version 0:1.5.10-2.el8 or higher.
This issue was patched in ELSA-2023-12011.

NVD Description

Note: Versions mentioned in the description apply only to the upstream olcne-oci-ccm-chart package and not the olcne-oci-ccm-chart package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in regexp.Compile in Go.

CVSS Scores

version 3.1
Expand this section

NVD

7.5 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    None
  • Integrity (I)
    None
  • Availability (A)
    High
Expand this section

Red Hat

7.5 high