GCVE - cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*

part: a version: 1.0 update: *

Vendor	Redhat (`e942785a-ca89-506e-bd99-50782639cde3`)
Product	Openshift Service Mesh (`99fb79ad-e987-595a-9fb7-592225bd475d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-3495`	vulnerable	2026-06-08 05:33:52.482691	Details available An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Published: 2021-06-01T13:31:32.000Z Updated: 2024-08-03T16:53:17.829Z Open on db.gcve.eu Reference links https://bugzilla.redhat.com/show_bug.cgi?id=1947361 https://kiali.io/news/security-bulletins/kiali-security-003/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-8659`	vulnerable	2026-06-08 05:27:17.134849	Details available CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. Published: 2020-03-04T20:43:55.000Z Updated: 2024-08-04T10:03:46.378Z Open on db.gcve.eu Reference links https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history https://github.com/envoyproxy/envoy/security/advisories/GHSA-jwcm-4pwp-c2qv https://access.redhat.com/errata/RHSA-2020:0734 https://lists.debian.org/debian-lts-announce/2022/05/msg00025.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-8595`	vulnerable	2026-06-08 05:27:16.983110	Details available Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match. Published: 2020-02-12T14:10:15.000Z Updated: 2024-08-04T10:03:45.884Z Open on db.gcve.eu Reference links https://github.com/istio/istio/commits/master https://istio.io/news/security/ https://access.redhat.com/errata/RHSA-2020:0477 https://access.redhat.com/security/cve/cve-2020-8595 https://istio.io/news/security/istio-security-2020-001/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-1764`	vulnerable	2026-06-08 05:21:03.004273	Details available HIGH (8.6) A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration. Published: 2020-03-26T11:16:09.000Z Updated: 2024-08-04T06:46:30.916Z Open on db.gcve.eu Reference links https://kiali.io/news/security-bulletins/kiali-security-001/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-1762`	vulnerable	2026-06-08 05:21:02.999638	Details available HIGH (7) An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration. Published: 2020-04-27T20:41:37.000Z Updated: 2024-08-04T06:46:30.907Z Open on db.gcve.eu Reference links https://kiali.io/news/security-bulletins/kiali-security-001/ https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9518`	vulnerable	2026-06-08 05:14:25.671723	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9517`	vulnerable	2026-06-08 05:14:25.661729	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9516`	vulnerable	2026-06-08 05:14:25.650845	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9515`	vulnerable	2026-06-08 05:14:25.647837	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9514`	vulnerable	2026-06-08 05:14:25.640472	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9513`	vulnerable	2026-06-08 05:14:25.626955	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-9511`	vulnerable	2026-06-08 05:14:25.611823	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-25014`	vulnerable	2026-06-08 05:13:41.806763	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.