CVE-2021-34824 - Vulnerability Details - OpenCVE

Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Istio	Istio

Configuration 1 [-]

OR	cpe:2.3:a:istio:istio::::::::
	cpe:2.3:a:istio:istio::::::::

No data.

References

Link	Providers
https://github.com/istio/istio/releases
https://istio.io/latest/news/security/istio-security-2021-007
https://istio.io/latest/news/security/istio-security-2021-007/
https://nvd.nist.gov/vuln/detail/CVE-2021-34824
https://www.cve.org/CVERecord?id=CVE-2021-34824

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-06-29T13:30:01

Updated: 2024-08-04T00:26:54.057Z

Reserved: 2021-06-17T00:00:00

Link: CVE-2021-34824

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-06-29T14:15:08.500

Modified: 2024-11-21T06:11:16.530

Link: CVE-2021-34824

Redhat

Severity : Important

Publid Date: 2021-06-29T00:00:00Z

Links: CVE-2021-34824 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-07-07T14:30:14", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/istio/istio/releases"}, {"tags": ["x_refsource_MISC"], "url": "https://istio.io/latest/news/security/istio-security-2021-007"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-34824", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/istio/istio/releases", "refsource": "MISC", "url": "https://github.com/istio/istio/releases"}, {"name": "https://istio.io/latest/news/security/istio-security-2021-007", "refsource": "MISC", "url": "https://istio.io/latest/news/security/istio-security-2021-007"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T00:26:54.057Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/istio/istio/releases"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://istio.io/latest/news/security/istio-security-2021-007"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-34824", "datePublished": "2021-06-29T13:30:01", "dateReserved": "2021-06-17T00:00:00", "dateUpdated": "2024-08-04T00:26:54.057Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A6CA313-1E72-4FB9-BC66-807867DC5D5F", "versionEndExcluding": "1.9.6", "versionStartIncluding": "1.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8E5F796-20CB-492C-89EE-700291C82018", "versionEndExcluding": "1.10.2", "versionStartIncluding": "1.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces."}, {"lang": "es", "value": "Istio (versiones 1.8.x, 1.9.0-1.9.5 y 1.10.0-1.10.1) contiene una vulnerabilidad explotable de forma remota en la que se puede acceder a las credenciales especificadas en el campo Gateway y DestinationRule credentialName desde diferentes espacios de nombres"}], "id": "CVE-2021-34824", "lastModified": "2024-11-21T06:11:16.530", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-06-29T14:15:08.500", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/istio/istio/releases"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://istio.io/latest/news/security/istio-security-2021-007"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/istio/istio/releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://istio.io/latest/news/security/istio-security-2021-007"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}