John Howard

**Name of the Vulnerable Software and Affected Versions** Linkerd versions 2.16.* through 2.16.4 Linkerd versions 2.17.* through 2.17.1 Linkerd versions 2.18.* (no specific end version mentioned, but before 2.18.0) Buoyant Edge versions before edge-25.2.1 **Description** Resource exhaustion can occur for Linkerd proxy metrics in the specified versions. **Recommendations** For Linkerd versions 2.16.* through 2.16.4, update to version 2.16.5 or later. For Linkerd versions 2.17.* through 2.17.1, update to version 2.17.2 or later. For Linkerd versions 2.18.* before 2.18.0, update to version 2.18.0 or later. For Buoyant Edge versions before edge-25.2.1, update to version edge-25.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** crypto/tls versions (affected versions not specified) golang (affected versions not specified) **Description** The issue arises when verifying a certificate chain that contains a certificate with an unknown public key algorithm, causing Certificate.Verify to panic. This affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior for TLS servers is to not verify client certificates. There is also a mention of a vulnerability in the golang package of the Debian GNU/Linux operating system related to insufficient exception handling, which can be exploited by a remote attacker to cause a denial of service (DoS). **Recommendations** For crypto/tls, consider disabling the Certificate.Verify function until a patch is available to prevent panic when encountering unknown public key algorithms. For golang, restrict the use of the vulnerable package to minimize the risk of exploitation until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** golang.org/x/net/http2/h2c (affected versions not specified) **Description** A request smuggling attack is possible when using MaxBytesHandler. The body of an HTTP request is not fully consumed, and when the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request. This could be attacker-manipulated to represent arbitrary HTTP2 requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Istio versions prior to 1.11.7 Istio versions prior to 1.12.4 Istio versions prior to 1.13.1 **Description** The Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially multicluster topologies, this port is exposed over the public internet. **Recommendations** For versions prior to 1.11.7, upgrade to Istio 1.11.7 or above. For versions prior to 1.12.4, upgrade to Istio 1.12.4 or above. For versions prior to 1.13.1, upgrade to Istio 1.13.1 or above. As a temporary workaround, consider limiting network access to Istiod to the minimal set of clients to help lessen the scope of the vulnerability.

Name of the Vulnerable Software and Affected Versions: Istio versions 1.8.x through 1.10.1 Description: The issue allows credentials specified in the Gateway and DestinationRule `credentialName` field to be accessed from different namespaces. This is a remotely exploitable vulnerability. Recommendations: For Istio versions 1.8.x through 1.10.1, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Istio versions 1.8.0 through 1.8.6 Istio versions 1.9.0 through 1.9.5 Description: The issue allows an external client to access unexpected services in the cluster, bypassing authorization checks, when a gateway is configured with AUTO PASSTHROUGH routing configuration. This can be exploited remotely. Recommendations: For Istio versions 1.8.0 through 1.8.6, update to version 1.8.6 or later. For Istio versions 1.9.0 through 1.9.5, update to version 1.9.5 or later. As a temporary workaround, consider changing the gateway routing configuration from AUTO PASSTHROUGH to a more restrictive setting to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Kubernetes (affected versions not specified) **Description** A security issue in Kubernetes allows a remote attacker to redirect pod traffic to private networks on a Node, potentially accessing confidential data and compromising its integrity. The issue is related to the lack of validation on EndpointSlice IPs, which was already performed on Endpoint IPs in the localhost or link-local range. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.