Istio publishes results of 2022 security audit

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2022-23635, CVE-2022-41721. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Istio is a project that platform engineers trust to enforce security policy in their production Kubernetes environments. We pay a lot of care to security in our code, and maintain a robust vulnerability program. To validate our work, we periodically invite external review of the project, and we are pleased to publish the results of our second security audit. The auditors’ assessment was that “Istio is a well-maintained project that has a strong and sustainable approach to security”. No critical issues were found; the highlight of the report was the discovery of a vulnerability in the Go programming language. We would like to thank the Cloud Native Computing Foundation for funding this work, as a benefit offered to us after we joined the CNCF in August. It was arranged by OSTIF, and performed by ADA Logics. Scope and overall findings Istio received its first security assessment in 2020, with its data plane, the Envoy proxy, having been independently assessed in 2018 and 2021. The Istio Product Security Working Group and ADA Logics therefore decided on the following scope:

Produce a formal threat model, to guide this and future security audits Carry out a manual code audit for security issues Review the fixes for the issues found in the 2020 audit Review and improve Istio’s fuzzing suite Perform a SLSA review of Istio

Once again, no Critical issues were found in the review. The assessment found 11 security issues; two High, four Medium, four Low and one informational. All the reported issues have been fixed.

“Istio is a very well-maintained and secure project …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2022-23635, CVE-2022-41721): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://istio.io/latest/blog/2023/ada-logics-security-assessment/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.