Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-21679: Authorization Policy bypass in Istio

CVE-2022-21679 · published 4 years ago

Summary

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
istio	istio	1.12.0 1.12.1 `cpe:2.3:a:istio:istio:1.12.0:-::::::`

Original advisory text

Authorization Policy bypass in Istio

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.

References

https://istio.io/latest/news/releases/1.12.x/announcing-1.12.2/ URL
https://github.com/istio/istio/security/advisories/GHSA-rwfr-xrvw-2rvv Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21679... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-21679 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

6.8 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-670Always-Incorrect Control Flow Implementation

Timeline

Published19 Jan 2022

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-21679 · NVD

CVE-2022-21679 · OSV

GHSA-rwfr-xrvw-2rvv · GHSA

Track software like this

Free during beta