News

Select security bulletins, release announcements, or support announcements to stay up to date.

Apr 24, 2024

Support for Istio 1.19 has ended

Istio 1.19 end of life announcement.

Support Announcements

Apr 22, 2024

ISTIO-SECURITY-2024-003

CVEs reported by Envoy.

CVE(s): CVE-2024-32475
CVSS: 7.5
Affected versions: All releases prior to 1.19.0 , 1.19.0 to 1.19.9 , 1.20.0 to 1.20.5 , 1.21.0 to 1.21.1

Security Bulletins

Apr 22, 2024

Announcing Istio 1.21.2

Istio 1.21.2 patch release.

Release Announcements

Apr 22, 2024

Announcing Istio 1.20.6

Istio 1.20.6 patch release.

Release Announcements

Apr 22, 2024

Announcing Istio 1.19.10

Istio 1.19.10 patch release.

Release Announcements

Apr 8, 2024

ISTIO-SECURITY-2024-002

CVEs reported by Envoy and Go.

CVE(s): CVE-2024-27919 , CVE-2024-30255 , CVE-2023-45288
CVSS: 7.5
Affected versions: All releases prior to 1.19.0 , 1.19.0 to 1.19.8 , 1.20.0 to 1.20.4 , 1.21.0

Security Bulletins

Apr 8, 2024

Announcing Istio 1.21.1

Istio 1.21.1 patch release.

Release Announcements

Apr 8, 2024

Announcing Istio 1.20.5

Istio 1.20.5 patch release.

Release Announcements

Apr 8, 2024

Announcing Istio 1.19.9

Istio 1.19.9 patch release.

Release Announcements

Mar 27, 2024

Support for Istio 1.19 ends on April 24, 2024

Upcoming Istio 1.19 end of life announcement.

Support Announcements

Mar 14, 2024

Announcing Istio 1.20.4

Istio 1.20.4 patch release.

Release Announcements

Mar 14, 2024

Announcing Istio 1.19.8

Istio 1.19.8 patch release.

Release Announcements

Mar 13, 2024

Announcing Istio 1.21.0

Istio 1.21 Release Announcement.

Release Announcements

Mar 13, 2024

Istio 1.21 Upgrade Notes

Important changes to consider when upgrading to Istio 1.21.x.

Release Announcements

Mar 13, 2024

Istio 1.21.0 Change Notes

Istio 1.21.0 release notes.

Release Announcements

Feb 9, 2024

ISTIO-SECURITY-2024-001

CVEs reported by Envoy.

CVE(s): CVE-2024-23322 , CVE-2024-23323 , CVE-2024-23324 , CVE-2024-23325 , CVE-2024-23327
CVSS: 8.6
Affected versions: All releases prior to 1.19.0 , 1.19.0 to 1.19.6 , 1.20.0 to 1.20.2

Security Bulletins

Feb 9, 2024

Announcing Istio 1.20.3

Istio 1.20.3 patch release.

Release Announcements

Feb 9, 2024

Announcing Istio 1.19.7

Istio 1.19.7 patch release.

Release Announcements

Jan 9, 2024

Announcing Istio 1.20.2

Istio 1.20.2 patch release.

Release Announcements

Jan 5, 2024

Announcing Istio 1.19.6

Istio 1.19.6 patch release.

Release Announcements

Jan 4, 2024

Support for Istio 1.18 has ended

Istio 1.18 end of life announcement.

Support Announcements

Jan 4, 2024

Announcing Istio 1.18.7

Istio 1.18.7 patch release.

Release Announcements

Dec 12, 2023

ISTIO-SECURITY-2023-005

Changes to Istio CNI RBAC permissions.

CVSS: N/A
Affected versions: All releases prior to 1.18.0 , 1.18.0 to 1.18.5 , 1.19.0 to 1.19.4 , 1.20.0

Security Bulletins

Dec 12, 2023

Announcing Istio 1.20.1

Istio 1.20.1 patch release.

Release Announcements

Dec 12, 2023

Announcing Istio 1.19.5

Istio 1.19.5 patch release.

Release Announcements

Dec 12, 2023

Announcing Istio 1.18.6

Istio 1.18.6 patch release.

Release Announcements

Nov 29, 2023

Support for Istio 1.18 ends on December 26, 2023

Upcoming Istio 1.18 end of life announcement.

Support Announcements

Nov 14, 2023

Announcing Istio 1.20.0

Istio 1.20 Release Announcement.

Release Announcements

Nov 14, 2023

Istio 1.20 Upgrade Notes

Important changes to consider when upgrading to Istio 1.20.

Release Announcements

Nov 14, 2023

Istio 1.20.0 Change Notes

Istio 1.20.0 change notes.

Release Announcements

Nov 13, 2023

Announcing Istio 1.19.4

Istio 1.19.4 patch release.

Release Announcements

Oct 27, 2023

Support for Istio 1.17 has ended

Istio 1.17 end of life announcement.

Support Announcements

Oct 11, 2023

ISTIO-SECURITY-2023-004

CVEs reported by Envoy and Go.

CVE(s): CVE-2023-44487 , CVE-2023-39325
CVSS: 7.5
Affected versions: All releases prior to 1.17.0 , 1.17.0 to 1.17.6 , 1.18.0 to 1.18.3 , 1.19.0 to 1.19.1

Security Bulletins

Oct 11, 2023

Announcing Istio 1.19.3

Istio 1.19.3 patch release.

Release Announcements

Oct 11, 2023

Announcing Istio 1.18.5

Istio 1.18.5 patch release.

Release Announcements

Oct 11, 2023

Announcing Istio 1.17.8

Istio 1.17.8 patch release.

Release Announcements

Oct 2, 2023

Announcing Istio 1.19.1

Istio 1.19.1 patch release.

Release Announcements

Sep 27, 2023

Support for Istio 1.17 ends on October 27, 2023

Upcoming Istio 1.17 end of life announcement.

Support Announcements

Sep 19, 2023

Announcing Istio 1.17.6

Istio 1.17.6 patch release.

Release Announcements

Sep 12, 2023

Announcing Istio 1.18.3

Istio 1.18.3 patch release.

Release Announcements

Sep 5, 2023

Announcing Istio 1.19.0

Istio 1.19 Release Announcement.

Release Announcements

Sep 5, 2023

Istio 1.19 Upgrade Notes

Important changes to consider when upgrading to Istio 1.19.

Release Announcements

Sep 5, 2023

Istio 1.19.0 Change Notes

Istio 1.19.0 change notes.

Release Announcements

Jul 25, 2023

Support for Istio 1.16 has ended

Istio 1.16 end of life announcement.

Support Announcements

Jul 25, 2023

ISTIO-SECURITY-2023-003

CVEs reported by Envoy.

CVE(s): CVE-2023-35941 , CVE-2023-35942 , CVE-2023-35943 , CVE-2023-35944
CVSS: 8.6
Affected versions: All releases prior to 1.16.0 , 1.16.0 to 1.16.6 , 1.17.0 to 1.17.4 , 1.18.0 to 1.18.1

Security Bulletins

Jul 25, 2023

Announcing Istio 1.18.2

Istio 1.18.2 patch release.

Release Announcements

Jul 25, 2023

Announcing Istio 1.17.5

Istio 1.17.5 patch release.

Release Announcements

Jul 25, 2023

Announcing Istio 1.16.7

Istio 1.16.7 patch release.

Release Announcements

Jul 14, 2023

ISTIO-SECURITY-2023-002

CVE reported by Envoy.

CVE(s): CVE-2023-35945
CVSS: 7.5
Affected versions: All releases prior to 1.16.0 , 1.16.0 to 1.16.5 , 1.17.0 to 1.17.3 , 1.18.0

Security Bulletins

Jul 14, 2023

Announcing Istio 1.18.1

Istio 1.18.1 patch release.

Release Announcements

Jul 14, 2023

Announcing Istio 1.17.4

Istio 1.17.4 patch release.

Release Announcements

Jul 14, 2023

Announcing Istio 1.16.6

Istio 1.16.6 patch release.

Release Announcements

Jun 19, 2023

Support for Istio 1.16 ends on July 19th, 2023

Upcoming Istio 1.16 end of life announcement.

Support Announcements

Jun 7, 2023

Announcing Istio 1.18.0

Istio 1.18 Release Announcement.

Release Announcements

Jun 7, 2023

Istio 1.18 Upgrade Notes

Important changes to consider when upgrading to Istio 1.18.0.

Release Announcements

Jun 7, 2023

Istio 1.18.0 Change Notes

Istio 1.18.0 change notes.

Release Announcements

Jun 6, 2023

Announcing Istio 1.17.3

Istio 1.17.3 patch release.

Release Announcements

May 23, 2023

Announcing Istio 1.16.5

Istio 1.16.5 patch release.

Release Announcements

Apr 4, 2023

Announcing Istio 1.17.2

Istio 1.17.2 patch release.

Release Announcements

Apr 4, 2023

Announcing Istio 1.16.4

Istio 1.16.4 patch release.

Release Announcements

Apr 4, 2023

Announcing Istio 1.15.7

Istio 1.15.7 patch release.

Release Announcements

Apr 4, 2023

Support for Istio 1.15 has ended

Istio 1.15 end of life announcement.

Support Announcements

Apr 4, 2023

ISTIO-SECURITY-2023-001

Multiple CVEs reported by Envoy.

CVE(s): CVE-2023-27496 , CVE-2023-27488 , CVE-2023-27493 , CVE-2023-27492 , CVE-2023-27491 , CVE-2023-27487
CVSS: 8.2
Affected versions: All releases prior to 1.15.0 , 1.15.0 to 1.15.6 , 1.16.0 to 1.16.3 , 1.17.0 to 1.17.1

Security Bulletins

Feb 26, 2023

Support for Istio 1.15 ends on March 28th, 2023

Upcoming Istio 1.15 end of life announcement.

Support Announcements

Feb 23, 2023

Announcing Istio 1.17.1

Istio 1.17.1 patch release.

Release Announcements

Feb 21, 2023

Announcing Istio 1.16.3

Istio 1.16.3 patch release.

Release Announcements

Feb 21, 2023

Announcing Istio 1.15.6

Istio 1.15.6 patch release.

Release Announcements

Feb 14, 2023

Announcing Istio 1.17

Istio 1.17 release annoucement.

Release Announcements

Feb 14, 2023

Istio 1.17 Upgrade Notes

Important changes to consider when upgrading to Istio 1.17.

Release Announcements

Feb 14, 2023

Istio 1.17.0 Change Notes

Istio 1.17.0 change notes.

Release Announcements

Jan 30, 2023

Announcing Istio 1.16.2

Istio 1.16.2 patch release.

Release Announcements

Jan 30, 2023

Announcing Istio 1.15.5

Istio 1.15.5 patch release.

Release Announcements

Dec 27, 2022

Support for Istio 1.14 has ended

Istio 1.14 end of life announcement.

Support Announcements

Dec 12, 2022

Announcing Istio 1.16.1

Istio 1.16.1 patch release.

Release Announcements

Dec 12, 2022

Announcing Istio 1.15.4

Istio 1.15.4 patch release.

Release Announcements

Dec 12, 2022

Announcing Istio 1.14.6

Istio 1.14.6 patch release.

Release Announcements

Dec 8, 2022

Support for Istio 1.14 ends on December 27th, 2022

Upcoming Istio 1.14 end of life announcement.

Support Announcements

Nov 15, 2022

Announcing Istio 1.16

Istio 1.16 release announcement.

Release Announcements

Nov 15, 2022

Istio 1.16 Upgrade Notes

Important changes to consider when upgrading to Istio 1.16.0.

Release Announcements

Nov 15, 2022

Istio 1.16.0 Change Notes

Istio 1.16.0 change notes.

Release Announcements

Nov 9, 2022

ISTIO-SECURITY-2022-008

Identity impersonation if user has localhost access.

CVE(s): CVE-2022-39388
CVSS: 7.6
Affected versions: 1.15.2

Security Bulletins

Oct 27, 2022

Announcing Istio 1.15.3

Istio 1.15.3 patch release.

Release Announcements

Oct 12, 2022

Support for Istio 1.13 has ended

Istio 1.13 end of life announcement.

Support Announcements

Oct 12, 2022

ISTIO-SECURITY-2022-007

Denial of service attack due to Go Regex Library.

CVE(s): CVE-2022-39278
CVSS: 7.5
Affected versions: All releases prior to 1.13 , 1.13.0 to 1.13.8 , 1.14.0 to 1.14.4 , 1.15.0 to 1.15.1

Security Bulletins

Oct 11, 2022

Announcing Istio 1.15.2

Istio 1.15.2 patch release.

Release Announcements

Oct 11, 2022

Announcing Istio 1.14.5

Istio 1.14.5 patch release.

Release Announcements

Oct 11, 2022

Announcing Istio 1.13.9

Istio 1.13.9 patch release.

Release Announcements

Sep 23, 2022

Announcing Istio 1.15.1

Istio 1.15.1 patch release.

Release Announcements

Sep 14, 2022

Support for Istio 1.13 ends on October 12th, 2022

Upcoming Istio 1.13 end of life announcement.

Support Announcements

Sep 12, 2022

Announcing Istio 1.14.4

Istio 1.14.4 patch release.

Release Announcements

Sep 12, 2022

Announcing Istio 1.13.8

Istio 1.13.8 patch release.

Release Announcements

Aug 31, 2022

Announcing Istio 1.15

Istio 1.15 release announcement.

Release Announcements

Aug 31, 2022

Istio 1.15 Upgrade Notes

Important changes to consider when upgrading to Istio 1.15.0.

Release Announcements

Aug 31, 2022

Istio 1.15.0 Change Notes

Istio 1.15.0 change notes.

Release Announcements

Aug 1, 2022

Announcing Istio 1.14.3

Istio 1.14.3 patch release.

Release Announcements

Aug 1, 2022

Announcing Istio 1.13.7

Istio 1.13.7 patch release.

Release Announcements

Jul 26, 2022

ISTIO-SECURITY-2022-006

Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.

CVE(s): CVE-2022-31045
CVSS: 5.9
Affected versions: 1.13.6 , 1.14.2

Security Bulletins

Jul 25, 2022

Announcing Istio 1.14.2

Istio 1.14.2 patch release.

Release Announcements

Jul 25, 2022

Announcing Istio 1.13.6

Istio 1.13.6 patch release.

Release Announcements

Jul 13, 2022

Support for Istio 1.12 has ended

Istio 1.12 end of life announcement.

Support Announcements

Jul 12, 2022

Announcing Istio 1.12.9

Istio 1.12.9 patch release.

Release Announcements

Jun 27, 2022

Support for Istio 1.12 ends on July 12th, 2022

Upcoming Istio 1.12 end of life announcement.

Support Announcements

Jun 9, 2022

ISTIO-SECURITY-2022-005

Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.

CVE(s): CVE-2022-31045 , CVE-2022-29225 , CVE-2022-29224 , CVE-2022-29226 , CVE-2022-29228 , CVE-2022-29227
CVSS: 7.5
Affected versions: All releases prior to 1.12.0 , 1.12.0 to 1.12.7 , 1.13.0 to 1.13.4 , 1.14.0

Security Bulletins

Jun 9, 2022

Announcing Istio 1.14.1

Istio 1.14.1 patch release.

Release Announcements

Jun 9, 2022

Announcing Istio 1.13.5

Istio 1.13.5 patch release.

Release Announcements

Jun 9, 2022

Announcing Istio 1.12.8

Istio 1.12.8 patch release.

Release Announcements

Jun 1, 2022

Announcing Istio 1.14

Istio 1.14 release announcement.

Release Announcements

May 24, 2022

Istio 1.14 Upgrade Notes

Important changes to consider when upgrading to Istio 1.14.0.

Release Announcements

May 24, 2022

Istio 1.14 Change Notes

Istio 1.14.0 change notes.

Release Announcements

May 17, 2022

Announcing Istio 1.13.4

Istio 1.13.4 patch release.

Release Announcements

May 6, 2022

Announcing Istio 1.12.7

Istio 1.12.7 patch release.

Release Announcements

Apr 18, 2022

Announcing Istio 1.13.3

Istio 1.13.3 patch release.

Release Announcements

Apr 6, 2022

Announcing Istio 1.12.6

Istio 1.12.6 patch release.

Release Announcements

Mar 25, 2022

Support for Istio 1.11 has ended

Istio 1.11 end of life announcement.

Support Announcements

Mar 16, 2022

Support for Istio 1.11 ends on March 25th, 2022

Upcoming Istio 1.11 end of life announcement.

Support Announcements

Mar 9, 2022

ISTIO-SECURITY-2022-004

Unauthenticated control plane denial of service attack due to stack exhaustion.

CVE(s): CVE-2022-24726 , CVE-2022-24921
CVSS: 7.5
Affected versions: All releases prior to 1.11.0 , 1.11.0 to 1.11.7 , 1.12.0 to 1.12.4 , 1.13.0 to 1.13.1

Security Bulletins

Mar 9, 2022

Announcing Istio 1.13.2

Istio 1.13.2 patch release.

Release Announcements

Mar 9, 2022

Announcing Istio 1.12.5

Istio 1.12.5 patch release.

Release Announcements

Mar 9, 2022

Announcing Istio 1.11.8

Istio 1.11.8 patch release.

Release Announcements

Feb 22, 2022

ISTIO-SECURITY-2022-003

Multiple CVEs related to istiod Denial of Service and Envoy.

CVE(s): CVE-2022-23635 , CVE-2021-43824 , CVE-2021-43825 , CVE-2021-43826 , CVE-2022-21654 , CVE-2022-21655 , CVE-2022-23606
CVSS: 7.5
Affected versions: All releases prior to 1.11.0 , 1.11.0 to 1.11.6 , 1.12.0 to 1.12.3 , 1.13.0

Security Bulletins

Feb 22, 2022

Announcing Istio 1.13.1

Istio 1.13.1 patch release.

Release Announcements

Feb 22, 2022

Announcing Istio 1.12.4

Istio 1.12.4 patch release.

Release Announcements

Feb 22, 2022

Announcing Istio 1.11.7

Istio 1.11.7 patch release.

Release Announcements

Feb 11, 2022

Announcing Istio 1.13

Istio 1.13 release announcement.

Release Announcements

Feb 11, 2022

Istio 1.13 Upgrade Notes

Important changes to consider when upgrading to Istio 1.13.0.

Release Announcements

Feb 11, 2022

Istio 1.13 Change Notes

Istio 1.13.0 change notes.

Release Announcements

Feb 10, 2022

Announcing Istio 1.12.3

Istio 1.12.3 patch release.

Release Announcements

Feb 3, 2022

Announcing Istio 1.11.6

Istio 1.11.6 patch release.

Release Announcements

Jan 18, 2022

ISTIO-SECURITY-2022-002

Privileged Escalation in Kubernetes Gateway API.

CVE(s): CVE-2022-21701
CVSS: 4.7
Affected versions: 1.12.0 to 1.12.1

Security Bulletins

Jan 18, 2022

ISTIO-SECURITY-2022-001

Authorization Policy For Host Rules During Upgrades.

CVE(s): CVE-2022-21679
CVSS: 6.8
Affected versions: 1.12.0 to 1.12.1

Security Bulletins

Jan 18, 2022

Announcing Istio 1.12.2

Istio 1.12.2 patch release.

Release Announcements

Jan 7, 2022

Support for Istio 1.10 has ended

Istio 1.10 end of life announcement.

Support Announcements

Dec 7, 2021

Announcing Istio 1.12.1

Istio 1.12.1 patch release.

Release Announcements

Dec 2, 2021

Announcing Istio 1.11.5

Istio 1.11.5 patch release.

Release Announcements

Nov 29, 2021

Announcing Istio 1.10.6

Istio 1.10.6 patch release.

Release Announcements

Nov 19, 2021

Support for Istio 1.10 ends on December 30th, 2021

Upcoming Istio 1.10 end of life announcement.

Support Announcements

Nov 18, 2021

Announcing Istio 1.12

Istio 1.12 release announcement.

Release Announcements

Nov 18, 2021

Istio 1.12 Upgrade Notes

Important changes to consider when upgrading to Istio 1.12.0.

Release Announcements

Nov 18, 2021

Istio 1.12 Change Notes

Istio 1.12.0 change notes.

Release Announcements

Oct 14, 2021

Announcing Istio 1.11.4

Istio 1.11.4 patch release.

Release Announcements

Oct 8, 2021

Support for Istio 1.9 has ended

Istio 1.9 end of life announcement.

Support Announcements

Oct 8, 2021

Announcing Istio 1.9.9

Istio 1.9.9 patch release.

Release Announcements

Oct 7, 2021

Announcing Istio 1.10.5

Istio 1.10.5 patch release.

Release Announcements

Sep 23, 2021

Announcing Istio 1.11.3

Istio 1.11.3 patch release.

Release Announcements

Sep 3, 2021

Revised - Support for Istio 1.9 ends on October 5th, 2021

Revised Istio 1.9 end of life announcement.

Support Announcements

Sep 2, 2021

Announcing Istio 1.11.2

Istio 1.11.2 patch release.

Release Announcements

Aug 24, 2021

ISTIO-SECURITY-2021-008

Multiple CVEs related to AuthorizationPolicy, EnvoyFilter and Envoy.

CVE(s): CVE-2021-32777 , CVE-2021-32781 , CVE-2021-32778 , CVE-2021-32780 , CVE-2021-39155 , CVE-2021-39156
CVSS: 8.6
Affected versions: All releases prior to 1.9.8 , 1.10.0 to 1.10.3 , 1.11.0

Security Bulletins

Aug 24, 2021

Announcing Istio 1.9.8

Istio 1.9.8 patch release.

Release Announcements

Aug 24, 2021

Announcing Istio 1.11.1

Istio 1.11.1 patch release.

Release Announcements

Aug 24, 2021

Announcing Istio 1.10.4

Istio 1.10.4 patch release.

Release Announcements

Aug 12, 2021

Announcing Istio 1.11

Istio 1.11 release announcement.

Release Announcements

Aug 12, 2021

Istio 1.11 Upgrade Notes

Important changes to consider when upgrading to Istio 1.11.0.

Release Announcements

Aug 12, 2021

Istio 1.11 Change Notes

Istio 1.11.0 release notes.

Release Announcements

Jul 22, 2021

Announcing Istio 1.9.7

Istio 1.9.7 patch release.

Release Announcements

Jul 21, 2021

Support for Istio 1.9 ends on August 24th, 2021

Upcoming Istio 1.9 end of life announcement.

Support Announcements

Jul 16, 2021

Announcing Istio 1.10.3

Istio 1.10.3 patch release.

Release Announcements

Jun 24, 2021

ISTIO-SECURITY-2021-007

Istio contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.

CVE(s): CVE-2021-34824
CVSS: 9.1
Affected versions: All 1.8 patch releases , 1.9.0 to 1.9.5 , 1.10.0 to 1.10.1

Security Bulletins

Jun 24, 2021

Announcing Istio 1.9.6

Istio 1.9.6 patch release.

Release Announcements

Jun 24, 2021

Announcing Istio 1.10.2

Istio 1.10.2 patch release.

Release Announcements

Jun 9, 2021

Announcing Istio 1.10.1

Istio 1.10.1 patch release.

Release Announcements

May 18, 2021

Announcing Istio 1.10

Istio 1.10 release announcement.

Release Announcements

May 18, 2021

Istio 1.10 Upgrade Notes

Important changes to consider when upgrading to Istio 1.10.0.

Release Announcements

May 18, 2021

Istio 1.10 Change Notes

Istio 1.10.0 release notes.

Release Announcements

May 12, 2021

Support for Istio 1.8 has ended

Istio 1.8 end of life announcement.

Support Announcements

May 11, 2021

ISTIO-SECURITY-2021-006

An external client can access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO_PASSTHROUGH routing configuration.

CVE(s): CVE-2021-31921
CVSS: 10
Affected versions: All releases prior to 1.8.6 , 1.9.0 to 1.9.4

Security Bulletins

May 11, 2021

ISTIO-SECURITY-2021-005

HTTP request paths with multiple slashes or escaped slash characters may bypass path based authorization rules.

CVE(s): CVE-2021-31920
CVSS: 8.1
Affected versions: All releases prior to 1.8.6 , 1.9.0 to 1.9.4

Security Bulletins

May 11, 2021

Announcing Istio 1.9.5

Istio 1.9.5 patch release.

Release Announcements

May 11, 2021

Announcing Istio 1.8.6

Istio 1.8.6 patch release.

Release Announcements

Apr 27, 2021

Announcing Istio 1.9.4

Istio 1.9.4 patch release.

Release Announcements

Apr 15, 2021

ISTIO-SECURITY-2021-004

Potential misuse of mTLS-only fields in AuthorizationPolicy with plain text traffic.

CVE(s): N/A
CVSS: N/A
Affected versions: All releases 1.5 and later

Security Bulletins

Apr 15, 2021

ISTIO-SECURITY-2021-003

CVE(s): CVE-2021-28683 , CVE-2021-28682 , CVE-2021-29258
CVSS: 7.5
Affected versions: All releases prior to 1.8.5 , 1.9.0 to 1.9.2

Security Bulletins

Apr 15, 2021

Announcing Istio 1.9.3

Istio 1.9.3 patch release.

Release Announcements

Apr 15, 2021

Announcing Istio 1.8.5

Istio 1.8.5 patch release.

Release Announcements

Apr 12, 2021

Support for Istio 1.8 ends on May 12th, 2021

Upcoming Istio 1.8 end of life announcement.

Support Announcements

Apr 7, 2021

ISTIO-SECURITY-2021-002

Upgrades from older Istio versions can affect access control to an ingress gateway due to a change of container ports.

CVE(s): N/A
CVSS: N/A
Affected versions: All releases 1.6 and later

Security Bulletins

Mar 25, 2021

Announcing Istio 1.9.2

Istio 1.9.2 patch release.

Release Announcements

Mar 10, 2021

Announcing Istio 1.8.4

Istio 1.8.4 patch release.

Release Announcements

Mar 1, 2021

ISTIO-SECURITY-2021-001

JWT authentication can be bypassed when AuthorizationPolicy is misused.

CVE(s): CVE-2021-21378
CVSS: 8.2
Affected versions: 1.9.0

Security Bulletins

Mar 1, 2021

Announcing Istio 1.9.1

Istio 1.9.1 patch release.

Release Announcements

Feb 25, 2021

Support for Istio 1.7 has ended

Istio 1.7 end of life announcement.

Support Announcements

Feb 25, 2021

Announcing Istio 1.7.8

Istio 1.7.8 patch release.

Release Announcements

Feb 9, 2021

Announcing Istio 1.9

Istio 1.9 release announcement.

Release Announcements

Feb 9, 2021

Istio 1.9 Upgrade Notes

Important changes to consider when upgrading to Istio 1.9.0.

Release Announcements

Feb 9, 2021

Istio 1.9 Change Notes

Istio 1.9.0 release notes.

Release Announcements

Feb 8, 2021

Announcing Istio 1.8.3

Istio 1.8.3 patch release.

Release Announcements

Jan 29, 2021

Announcing Istio 1.7.7

Istio 1.7.7 patch release.

Release Announcements

Jan 19, 2021

Support for Istio 1.7 ends on February 19th, 2021

Upcoming Istio 1.7 end of life announcement.

Support Announcements

Jan 14, 2021

Announcing Istio 1.8.2

Istio 1.8.2 patch release.

Release Announcements

Dec 10, 2020

Announcing Istio 1.7.6

Istio 1.7.6 patch release.

Release Announcements

Dec 8, 2020

Announcing Istio 1.8.1

Istio 1.8.1 patch release.

Release Announcements

Nov 23, 2020

Support for Istio 1.6 has ended

Istio 1.6 end of life announcement.

Support Announcements

Nov 23, 2020

Announcing Istio 1.6.14

Istio 1.6.14 patch release.

Release Announcements

Nov 21, 2020

ISTIO-SECURITY-2020-011

Envoy incorrectly restores the proxy protocol downstream address for non-HTTP connections.

CVE(s): N/A
CVSS: N/A
Affected versions: 1.8.0

Security Bulletins

Nov 19, 2020

Announcing Istio 1.8

Istio 1.8 release announcement.

Release Announcements

Nov 19, 2020

Announcing Istio 1.7.5

Istio 1.7.5 patch release.

Release Announcements

Nov 19, 2020

Istio 1.8 Upgrade Notes

Important changes to consider when upgrading to Istio 1.8.

Release Announcements

Nov 19, 2020

Istio 1.8 Change Notes

Istio 1.8 release notes.

Release Announcements

Oct 27, 2020

Announcing Istio 1.7.4

Istio 1.7.4 patch release.

Release Announcements

Oct 27, 2020

Announcing Istio 1.6.13

Istio 1.6.13 patch release.

Release Announcements

Oct 20, 2020

Support for Istio 1.6 ends on November 21st, 2020

Upcoming Istio 1.6 end of life announcement.

Support Announcements

Oct 6, 2020

Announcing Istio 1.6.12

Istio 1.6.12 patch release.

Release Announcements

Sep 29, 2020

ISTIO-SECURITY-2020-010

CVE(s): CVE-2020-25017
CVSS: 8.3
Affected versions: 1.6 to 1.6.10 , 1.7 to 1.7.2

Security Bulletins

Sep 29, 2020

Announcing Istio 1.7.3

Istio 1.7.3 security release.

Release Announcements

Sep 29, 2020

Announcing Istio 1.6.11

Istio 1.6.11 security release.

Release Announcements

Sep 22, 2020

Announcing Istio 1.6.10

Istio 1.6.10 patch release.

Release Announcements

Sep 18, 2020

Announcing Istio 1.7.2

Istio 1.7.2 patch release.

Release Announcements

Sep 10, 2020

Announcing Istio 1.7.1

Istio 1.7.1 patch release.

Release Announcements

Sep 9, 2020

Announcing Istio 1.6.9

Istio 1.6.9 patch release.

Release Announcements

Aug 24, 2020

Support for Istio 1.5 has ended

Istio 1.5 end of life announcement.

Support Announcements

Aug 24, 2020

Announcing Istio 1.5.10

Istio 1.5.10 patch release.

Release Announcements

Aug 21, 2020

Announcing Istio 1.7

Istio 1.7 release announcement.

Release Announcements

Aug 21, 2020

Istio 1.7 Upgrade Notes

Important changes to consider when upgrading to Istio 1.7.

Release Announcements

Aug 21, 2020

Istio 1.7 Change Notes

Istio 1.7 release notes.

Release Announcements

Aug 11, 2020

ISTIO-SECURITY-2020-009

Incorrect Envoy configuration for wildcard suffixes used for Principals/Namespaces in Authorization Policies for TCP Services.

CVE(s): CVE-2020-16844
CVSS: 6.8
Affected versions: 1.5 to 1.5.8 , 1.6 to 1.6.7

Security Bulletins

Aug 11, 2020

Announcing Istio 1.6.8

Istio 1.6.8 patch release.

Release Announcements

Aug 11, 2020

Announcing Istio 1.5.9

Istio 1.5.9 security release.

Release Announcements

Jul 30, 2020

Announcing Istio 1.6.7

Istio 1.6.7 patch release.

Release Announcements

Jul 29, 2020

Announcing Istio 1.6.6

Istio 1.6.6 patch release.

Release Announcements

Jul 22, 2020

Support for Istio 1.5 ends on August 21st, 2020

Upcoming Istio 1.5 end of life announcement.

Support Announcements

Jul 9, 2020

ISTIO-SECURITY-2020-008

Incorrect validation of wildcard DNS Subject Alternative Names.

CVE(s): CVE-2020-15104
CVSS: 6.6
Affected versions: 1.5 to 1.5.7 , 1.6 to 1.6.4 , All releases prior to 1.5

Security Bulletins

Jul 9, 2020

Announcing Istio 1.6.5

Istio 1.6.5 patch release.

Release Announcements

Jul 9, 2020

Announcing Istio 1.5.8

Istio 1.5.8 security release.

Release Announcements

Jun 30, 2020

ISTIO-SECURITY-2020-007

Multiple denial of service vulnerabilities in Envoy.

CVE(s): CVE-2020-12603 , CVE-2020-12605 , CVE-2020-8663 , CVE-2020-12604
CVSS: 7.5
Affected versions: 1.5 to 1.5.6 , 1.6 to 1.6.3

Security Bulletins

Jun 30, 2020

Announcing Istio 1.6.4

Istio 1.6.4 security release.

Release Announcements

Jun 30, 2020

Announcing Istio 1.5.7

Istio 1.5.7 security release.

Release Announcements

Jun 22, 2020

Announcing Istio 1.4.10

Istio 1.4.10 security release.

Release Announcements

Jun 18, 2020

Announcing Istio 1.6.3

Istio 1.6.3 patch release.

Release Announcements

Jun 17, 2020

Announcing Istio 1.5.6

Istio 1.5.6 patch release.

Release Announcements

Jun 11, 2020

ISTIO-SECURITY-2020-006

Denial of service in the HTTP2 library used by Envoy.

CVE(s): CVE-2020-11080
CVSS: 7.5
Affected versions: 1.4 to 1.4.9 , 1.5 to 1.5.4 , 1.6 to 1.6.1

Security Bulletins

Jun 11, 2020

Announcing Istio 1.6.2

Istio 1.6.2 security release.

Release Announcements

Jun 11, 2020

Announcing Istio 1.5.5

Istio 1.5.5 security release.

Release Announcements

Jun 5, 2020

Support for Istio 1.4 has ended

Istio 1.4 end of life announcement.

Support Announcements

Jun 4, 2020

Announcing Istio 1.6.1

Istio 1.6.1 patch release.

Release Announcements

May 21, 2020

Announcing Istio 1.6

Istio 1.6 release announcement.

Release Announcements

May 21, 2020

Istio 1.6 Upgrade Notes

Important changes to consider when upgrading to Istio 1.6.

Release Announcements

May 21, 2020

Istio 1.6 Change Notes

Istio 1.6 release notes.

Release Announcements

May 13, 2020

Announcing Istio 1.5.4

Istio 1.5.4 security release.

Release Announcements

May 12, 2020

ISTIO-SECURITY-2020-005

Denial of service affecting telemetry v2.

CVE(s): CVE-2020-10739
CVSS: 7.5
Affected versions: 1.4 to 1.4.8 , 1.5 to 1.5.3

Security Bulletins

May 12, 2020

Announcing Istio 1.5.3

Istio 1.5.3 security release.

Release Announcements

May 12, 2020

Announcing Istio 1.4.9

Istio 1.4.9 patch release.

Release Announcements

May 5, 2020

Support for Istio 1.4 ends on June 5th, 2020

Upcoming Istio 1.4 end of life announcement.

Support Announcements

Apr 24, 2020

Announcing Istio 1.5.2

Istio 1.5.2 patch release.

Release Announcements

Apr 23, 2020

Announcing Istio 1.4.8

Istio 1.4.8 patch release.

Release Announcements

Mar 25, 2020

ISTIO-SECURITY-2020-004

Default Kiali security configuration allows full control of mesh.

CVE(s): CVE-2020-1764
CVSS: 8.7
Affected versions: 1.4 to 1.4.6 , 1.5

Security Bulletins

Mar 25, 2020

Announcing Istio 1.5.1

Istio 1.5.1 patch release.

Release Announcements

Mar 25, 2020

Announcing Istio 1.4.7

Istio 1.4.7 patch release.

Release Announcements

Mar 5, 2020

Announcing Istio 1.5

Istio 1.5 release announcement.

Release Announcements

Mar 5, 2020

Istio 1.5 Upgrade Notes

Important changes to consider when upgrading to Istio 1.5.

Release Announcements

Mar 5, 2020

Istio 1.5 Change Notes

Istio 1.5 release notes.

Release Announcements

Mar 3, 2020

ISTIO-SECURITY-2020-003

Two uncontrolled resource consumption and two incorrect access control vulnerabilities in Envoy.

CVE(s): CVE-2020-8659 , CVE-2020-8660 , CVE-2020-8661 , CVE-2020-8664
CVSS: 7.5
Affected versions: 1.4 to 1.4.5

Security Bulletins

Mar 3, 2020

Announcing Istio 1.4.6

Istio 1.4.6 patch release.

Release Announcements

Feb 18, 2020

Announcing Istio 1.4.5

Istio 1.4.5 patch release.

Release Announcements

Feb 14, 2020

Support for Istio 1.3 has ended

Istio 1.3 end of life announcement.

Support Announcements

Feb 11, 2020

ISTIO-SECURITY-2020-002

Mixer policy check bypass caused by improperly accepting certain request headers.

CVE(s): CVE-2020-8843
CVSS: 7.4
Affected versions: 1.3 to 1.3.6

Security Bulletins

Feb 11, 2020

ISTIO-SECURITY-2020-001

Authentication Policy bypass.

CVE(s): CVE-2020-8595
CVSS: 9.0
Affected versions: 1.3 to 1.3.7 , 1.4 to 1.4.3

Security Bulletins

Feb 11, 2020

Announcing Istio 1.4.4

Istio 1.4.4 patch release.

Release Announcements

Feb 11, 2020

Announcing Istio 1.3.8

Istio 1.3.8 patch release.

Release Announcements

Feb 4, 2020

Announcing Istio 1.3.7

Istio 1.3.7 patch release.

Release Announcements

Jan 15, 2020

Support for Istio 1.3 ends on February 14th, 2020

Upcoming Istio 1.3 end of life announcement.

Support Announcements

Jan 8, 2020

Announcing Istio 1.4.3

Istio 1.4.3 patch release.

Release Announcements

Dec 13, 2019

Support for Istio 1.2 has ended

Istio 1.2 end of life announcement.

Support Announcements

Dec 10, 2019

ISTIO-SECURITY-2019-007

Heap overflow and improper input validation in Envoy.

CVE(s): CVE-2019-18801 , CVE-2019-18802
CVSS: 9.0
Affected versions: 1.2 to 1.2.9 , 1.3 to 1.3.5 , 1.4 to 1.4.1

Security Bulletins

Dec 10, 2019

Announcing Istio 1.4.2

Istio 1.4.2 patch release.

Release Announcements

Dec 10, 2019

Announcing Istio 1.3.6

Istio 1.3.6 patch release.

Release Announcements

Dec 10, 2019

Announcing Istio 1.2.10

Istio 1.2.10 patch release.

Release Announcements

Dec 5, 2019

Announcing Istio 1.4.1

Istio 1.4.1 patch release.

Release Announcements

Nov 14, 2019

Announcing Istio 1.4

Istio 1.4 release announcement.

Release Announcements

Nov 14, 2019

Istio 1.4 Upgrade Notes

Important changes to consider when upgrading to Istio 1.4.

Release Announcements

Nov 14, 2019

Istio 1.4 Change Notes

Istio 1.4 release notes.

Release Announcements

Nov 11, 2019

Support for Istio 1.2 ends on December 13th, 2019

Upcoming Istio 1.2 end of life announcement.

Support Announcements

Nov 11, 2019

Announcing Istio 1.3.5

Istio 1.3.5 patch release.

Release Announcements

Nov 7, 2019

ISTIO-SECURITY-2019-006

Denial of service.

CVE(s): CVE-2019-18817
CVSS: 7.5
Affected versions: 1.3 to 1.3.4

Security Bulletins

Nov 6, 2019

Announcing Istio 1.2.9

Istio 1.2.9 patch release.

Release Announcements

Nov 1, 2019

Announcing Istio 1.3.4

Istio 1.3.4 patch release.

Release Announcements

Oct 23, 2019

Announcing Istio 1.2.8

Istio 1.2.8 patch release.

Release Announcements

Oct 21, 2019

Support for Istio 1.1 has ended

Istio 1.1 end of life announcement.

Support Announcements

Oct 21, 2019

Announcing Istio 1.1.17

Istio 1.1.17 patch release.

Release Announcements

Oct 14, 2019

Announcing Istio 1.3.3

Istio 1.3.3 patch release.

Release Announcements

Oct 8, 2019

ISTIO-SECURITY-2019-005

Denial of service caused by the presence of numerous HTTP headers in client requests.

CVE(s): CVE-2019-15226
CVSS: 7.5
Affected versions: 1.1 to 1.1.15 , 1.2 to 1.2.6 , 1.3 to 1.3.1

Security Bulletins

Oct 8, 2019

Announcing Istio 1.3.2

Istio 1.3.2 patch release.

Release Announcements

Oct 8, 2019

Announcing Istio 1.2.7

Istio 1.2.7 patch release.

Release Announcements

Oct 8, 2019

Announcing Istio 1.1.16

Istio 1.1.16 patch release.

Release Announcements

Sep 27, 2019

Announcing Istio 1.3.1

Istio 1.3.1 patch release.

Release Announcements

Sep 17, 2019

Announcing Istio 1.2.6

Istio 1.2.6 patch release.

Release Announcements

Sep 16, 2019

Announcing Istio 1.1.15

Istio 1.1.15 patch release.

Release Announcements

Sep 12, 2019

Announcing Istio 1.3

Istio 1.3 release announcement.

Release Announcements

Sep 12, 2019

Istio 1.3 Helm Changes

Details the Helm chart installation options differences between Istio 1.2 and Istio 1.3.

Release Announcements

Sep 12, 2019

Istio 1.3 Upgrade Notes

Important changes to consider when upgrading to Istio 1.3.

Release Announcements

Sep 12, 2019

Istio 1.3 Change Notes

Istio 1.3 release notes.

Release Announcements

Sep 10, 2019

Istio 1.2.4 sidecar image vulnerability

An erroneous 1.2.4 sidecar image was available due to a faulty release operation.

Affected versions: 1.2 to 1.2.4

Security Bulletins

Aug 26, 2019

Announcing Istio 1.2.5

Istio 1.2.5 patch release.

Release Announcements

Aug 26, 2019

Announcing Istio 1.1.14

Istio 1.1.14 patch release.

Release Announcements

Aug 15, 2019

Support for Istio 1.1 ends on September 19th, 2019

Upcoming Istio 1.1 end of life announcement.

Support Announcements

Aug 13, 2019

ISTIO-SECURITY-2019-004

Multiple denial of service vulnerabilities related to HTTP2 support in Envoy.

CVE(s): CVE-2019-9512 , CVE-2019-9513 , CVE-2019-9514 , CVE-2019-9515 , CVE-2019-9518
CVSS: 7.5
Affected versions: 1.1 to 1.1.12 , 1.2 to 1.2.3

Security Bulletins

Aug 13, 2019

ISTIO-SECURITY-2019-003

Denial of service in regular expression parsing.

CVE(s): CVE-2019-14993
CVSS: 7.5
Affected versions: 1.1 to 1.1.12 , 1.2 to 1.2.3

Security Bulletins

Aug 13, 2019

Announcing Istio 1.2.4

Istio 1.2.4 patch release.

Release Announcements

Aug 13, 2019

Announcing Istio 1.1.13

Istio 1.1.13 patch release.

Release Announcements

Aug 2, 2019

Announcing Istio 1.2.3

Istio 1.2.3 patch release.

Release Announcements

Aug 2, 2019

Announcing Istio 1.1.12

Istio 1.1.12 patch release.

Release Announcements

Jul 3, 2019

Announcing Istio 1.1.11

Istio 1.1.11 patch release.

Release Announcements

Jun 28, 2019

ISTIO-SECURITY-2019-002

Denial of service affecting JWT access token parsing.

CVE(s): CVE-2019-12995
CVSS: 7.5
Affected versions: 1.0 to 1.0.8 , 1.1 to 1.1.9 , 1.2 to 1.2.1

Security Bulletins

Jun 28, 2019

Announcing Istio 1.2.2

Istio 1.2.2 patch release.

Release Announcements

Jun 28, 2019

Announcing Istio 1.1.10

Istio 1.1.10 patch release.

Release Announcements

Jun 28, 2019

Announcing Istio 1.0.9

Istio 1.0.9 patch release.

Release Announcements

Jun 27, 2019

Announcing Istio 1.2.1

Istio 1.2.1 patch release.

Release Announcements

Jun 19, 2019

Support for Istio 1.0 has ended

Istio 1.0 end of life announcement.

Support Announcements

Jun 18, 2019

Announcing Istio 1.2

Istio 1.2 release announcement.

Release Announcements

Jun 18, 2019

Istio 1.2 Helm Changes

Details the Helm chart installation options differences between Istio 1.1 and Istio 1.2.

Release Announcements

Jun 18, 2019

Istio 1.2 Upgrade Notes

Important changes operators must understand before upgrading to Istio 1.2.

Release Announcements

Jun 18, 2019

Istio 1.2 Change Notes

Istio 1.2 release notes.

Release Announcements

Jun 17, 2019

Announcing Istio 1.1.9

Istio 1.1.9 patch release.

Release Announcements

Jun 7, 2019

Announcing Istio 1.0.8

Istio 1.0.8 patch release.

Release Announcements

Jun 6, 2019

Announcing Istio 1.1.8

Istio 1.1.8 patch release.

Release Announcements

May 28, 2019

ISTIO-SECURITY-2019-001

Incorrect access control.

CVE(s): CVE-2019-12243
CVSS: 8.9
Affected versions: 1.1 to 1.1.6

Security Bulletins

May 23, 2019

Support for Istio 1.0 ends on June 19th, 2019

Upcoming Istio 1.0 end of life announcement.

Support Announcements

May 17, 2019

Announcing Istio 1.1.7

Istio 1.1.7 patch release.

Release Announcements

May 11, 2019

Announcing Istio 1.1.6

Istio 1.1.6 patch release.

Release Announcements

May 3, 2019

Announcing Istio 1.1.5

Istio 1.1.5 patch release.

Release Announcements

Apr 24, 2019

Announcing Istio 1.1.4

Istio 1.1.4 patch release.

Release Announcements

Apr 15, 2019

Announcing Istio 1.1.3

Istio 1.1.3 patch release.

Release Announcements

Apr 5, 2019

Announcing Istio 1.1.2 with Important Security Update

Istio 1.1.2 patch release.

Release Announcements

Apr 5, 2019

Announcing Istio 1.0.7 with Important Security Update

Istio 1.0.7 patch release.

Release Announcements

Mar 25, 2019

Announcing Istio 1.1.1

Istio 1.1.1 patch release.

Release Announcements

Mar 19, 2019

Announcing Istio 1.1

Istio 1.1 release announcement.

Release Announcements

Mar 19, 2019

Istio 1.1 Helm Changes

Details the Helm chart installation options differences between Istio 1.0 and Istio 1.1.

Release Announcements

Mar 19, 2019

Istio 1.1 Upgrade Notes

Important changes operators must understand before upgrading to Istio 1.1.

Release Announcements

Mar 19, 2019

Istio 1.1 Change Notes

Istio 1.1 release notes.

Release Announcements

Feb 12, 2019

Announcing Istio 1.0.6

Istio 1.0.6 patch release.

Release Announcements

Dec 20, 2018

Announcing Istio 1.0.5

Istio 1.0.5 patch release.

Release Announcements

Nov 21, 2018

Announcing Istio 1.0.4

Istio 1.0.4 patch release.

Release Announcements

Oct 30, 2018

Announcing Istio 1.0.3

Istio 1.0.3 patch release.

Release Announcements

Sep 6, 2018

Announcing Istio 1.0.2

Istio 1.0.2 patch release.

Release Announcements

Aug 29, 2018

Announcing Istio 1.0.1

Istio 1.0.1 patch release.

Release Announcements

Jul 31, 2018

Announcing Istio 1.0

Istio is ready for production use with its 1.0 release.

Release Announcements

Jun 1, 2018

Announcing Istio 0.8

Istio 0.8 announcement.

Release Announcements

Mar 28, 2018

Announcing Istio 0.7

Istio 0.7 announcement.

Release Announcements

Mar 8, 2018

Announcing Istio 0.6

Istio 0.6 announcement.

Release Announcements

Feb 2, 2018

Announcing Istio 0.5

Istio 0.5 announcement.

Release Announcements

Dec 18, 2017

Announcing Istio 0.4

Istio 0.4 announcement.

Release Announcements

Nov 29, 2017

Announcing Istio 0.3

Istio 0.3 announcement.

Release Announcements

Oct 10, 2017

Announcing Istio 0.2

Istio 0.2 announcement.

Release Announcements

May 24, 2017

Introducing Istio

Istio 0.1 announcement.

Release Announcements