Istio

Check if affected (7)

• ▸▾securityAmbient-mode PeerAuthentication enforcement, GHSA-rr2c-p22p-6r9r

  Applies if you use ambient mode with a mesh-wide STRICT policy and a workload mode of PERMISSIVE or DISABLE.

  Istio 1.31.4 fixes an operator-precedence error that could skip a port-level STRICT PeerAuthentication in ambient mode when the workload mode was PERMISSIVE or DISABLE under a mesh-wide STRICT policy. This prevented plaintext traffic from reaching a port that required mTLS.

• ▸▾securityCase-insensitive AuthorizationPolicy host conditions, GHSA-7m6f-j3gp-2r53

  Applies if you use AuthorizationPolicy conditions on request.headers[:authority] or request.headers[host].

  Istio 1.31.4 changes AuthorizationPolicy conditions on request.headers[:authority] and request.headers[host] to case-insensitive matching, consistent with host matching. This prevents differently cased host values from bypassing the policy.

• ▸▾securitysidecar proxy conntrack handling, GHSA-cxwg-46mx-q8hf

  Applies if a sidecar proxy receives a new inbound connection that reuses the 4-tuple of a torn-down connection.

  Istio 1.31.4 fixes stale conntrack handling that could let a new inbound connection bypass the sidecar proxy when it reused the 4-tuple of a torn-down connection.

• ▸▾securityistiod xDS resource-name parsing, GHSA-635j-qv98-9275

  Applies if a workload with a mesh identity sends an istio.io/debug xDS request with a resource name that fails URL parsing.

  Istio 1.31.4 prevents istiod from crashing when a workload with a mesh identity sends an istio.io/debug xDS request whose resource name fails URL parsing. The fix prevents the resulting control-plane crash loop.

• ▸▾securityAmbient-mode AuthorizationPolicy validation, GHSA-8jw7-82jp-wr2c

  Applies if you use ambient mode with an AuthorizationPolicy containing an empty to or from entry.

  Istio 1.31.4 rejects the empty to or from entries that previously could make istiod crash in ambient mode when accepted by the validating webhook. This prevents a crash loop that stopped configuration distribution across the mesh.

• ▸▾securityMulticluster CLUSTER_ID validation, GHSA-gf6w-6mxv-5fj4

  Applies if you use multicluster installations.

  Istio 1.31.4 fixes cluster identity handling in multicluster installations so a proxy cannot claim another cluster's CLUSTER_ID and receive that cluster's Kubernetes secrets over SDS.

• ▸▾securityztunnel traceparent parsing, GHSA-77vw-rg85-wx5x

  Applies if ztunnel receives a 55-byte traceparent header without four dash-separated fields on an inbound HBONE connection.

  Istio 1.31.4 fixes a ztunnel panic when parsing a 55-byte traceparent header without four dash-separated fields. The fix prevents the inbound HBONE connection task from terminating and dropping every multiplexed stream on that connection.