{"id":"GHSA-6g5f-f5pm-mjrg","summary":"Istio may not check inbound TCP connections against istio-policy","details":"Istio 1.1.x through 1.1.6 has Incorrect Access Control. When `disablePolicyChecks` is set to `false`, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.\n\nThis behavior is a result of a change to `istio/pilot/pkg/networking/plugin/mixer/mixer.go` in 1.1.\n","aliases":["CVE-2019-12243"],"modified":"2023-11-08T04:01:03.200373Z","published":"2022-02-15T01:57:18Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-05-17T15:53:48Z","nvd_published_at":null,"cwe_ids":["CWE-284"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12243"},{"type":"WEB","url":"https://github.com/istio/istio/issues/13868"},{"type":"WEB","url":"https://github.com/istio/istio/pull/13893/commits/91faba277439dab798185730d1624bd53e37bb06"},{"type":"WEB","url":"https://istio.io/blog/2019/cve-2019-12243"}],"affected":[{"package":{"name":"istio.io/istio","ecosystem":"Go","purl":"pkg:golang/istio.io/istio"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.0"},{"fixed":"1.1.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-6g5f-f5pm-mjrg/GHSA-6g5f-f5pm-mjrg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C"}]}