Announcing Istio 1.3.6
This release contains fixes for the security vulnerability described in our December 10th, 2019 news post as well as bug fixes to improve robustness. This release note describes what’s different between Istio 1.3.5 and Istio 1.3.6.
BEFORE YOU UPGRADE
Things to know and prepare before upgrading.
Download and install this release.
Visit the documentation for this release.
Inspect the full set of source code changes.
- ISTIO-SECURITY-2019-007 A heap overflow and improper input validation have been discovered in Envoy.
CVE-2019-18801: Fix a vulnerability affecting Envoy’s processing of large HTTP/2 request headers. A successful exploitation of this vulnerability could lead to a denial of service, escalation of privileges, or information disclosure. CVE-2019-18802: Fix a vulnerability resulting from whitespace after HTTP/1 header values which could allow an attacker to bypass Istio’s policy checks, potentially resulting in information disclosure or escalation of privileges. CVE-2019-18838: Fix a vulnerability resulting from malformed HTTP request missing the “Host” header. An encoder filter that invokes Envoy’s route manager APIs that access request’s “Host” header will cause a NULL pointer to be dereferenced and result in abnormal termination of the Envoy process.
- Fixed an issue where a duplicate listener was generated for a proxy’s IP address when using a headless
TCPservice. (Issue 17748)
- Fixed an issue with the
destination_servicelabel in HTTP related metrics incorrectly falling back to
request.hostwhich can cause a metric cardinality explosion for ingress traffic. (Issue 18818)
- Improved load-shedding options for Mixer. Added support for a
requests-per-secondthreshold for load-shedding enforcement. This allows operators to turn off load-shedding for Mixer in low traffic scenarios.