CVE-2022-39278

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2022-39278

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39278.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-39278

Aliases

GHSA-86vr-4wcv-mm9w

Published

2022-10-13T00:00:00Z

Modified

2025-11-28T04:54:30.156688Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Istio vulnerable to denial of service attack due to Golang Regex Library

Details

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in regexp.Compile in Go.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39278.json",
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

Git / github.com/istio/istio

Affected ranges

Type

GIT

Repo

https://github.com/istio/istio

Events

Introduced

Fixed

33409be6ea5c117e9ebaa08222eb58186b509b84

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.9"
        }
    ]
}

Type

GIT

Repo

https://github.com/istio/istio

Events

Introduced

3aa487bb6ec8cb8bb7c736423f3a4857d1a81263

Fixed

38a552d954e80615349e11c45d580f5def738b3d

Database specific

{
    "versions": [
        {
            "introduced": "1.14.0"
        },
        {
            "fixed": "1.14.5"
        }
    ]
}

Type

GIT

Repo

https://github.com/istio/istio

Events

Introduced

e3364ab424b70ca8ee1ca76cb0b3afb73476aaac

Fixed

b542583af7f8240ad0c9cab56eb9f8d55e1357ab

Database specific

{
    "versions": [
        {
            "introduced": "1.15.0"
        },
        {
            "fixed": "1.15.2"
        }
    ]
}

Affected versions

0.*

0.3.0

0.5.0

0.6.0

1.*

1.0.0

1.0.0-snapshot.0

1.0.0-snapshot.1

1.0.0-snapshot.2

1.1.0

1.1.0-rc.0

1.1.0-rc.1

1.1.0-rc.2

1.1.0-rc.3

1.1.0-rc.4

1.1.0-rc.5

1.1.0-rc.6

1.1.0-snapshot.2

1.1.0-snapshot.3

1.1.0-snapshot.4

1.1.0-snapshot.5

1.1.0-snapshot.6

1.1.0.snapshot.0

1.1.0.snapshot.1

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.12.0-alpha.0

1.12.0-alpha.1

1.12.0-alpha.5

1.13.0

1.13.0-beta.0

1.13.0-beta.1

1.13.2

1.13.3

1.13.4

1.13.6

1.13.7

1.13.8

1.14.0

1.14.2

1.14.3

1.14.4

1.15.0

1.15.1

1.2.0-rc.0

1.2.0-rc.3

1.5.0-alpha.0

1.5.0-beta.1

1.5.0-beta.2

1.6.0-alpha.0

1.6.0-alpha.1

1.6.0-alpha.2

1.7.0-alpha.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39278.json"