GHSA-6g5f-f5pm-mjrg
Istio may not check inbound TCP connections against istio-policy
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | istio.io/istio | >= 1.1.0, < 1.1.7 | 1.1.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
Istio 1.1.x through 1.1.6 has Incorrect Access Control. When `disablePolicyChecks` is set to `false`, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.
This behavior is a result of a change to `istio/pilot/pkg/networking/plugin/mixer/mixer.go` in 1.1.
References
External links from the advisory. They lead to third-party sites.