Vulnerability · Published Aug 22, 2022 · Assigned by redhat
CVE-2021-3586
Critical 9.8
In plain English
A critical-severity security flaw in servicemesh-operator. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.0%top 36.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | servicemesh-operator | Affects v2.0.5.1, Fixed in v2.0.5.2. |
Weakness: CWE-1188
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1967738 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2021-3586 x_refsource_MISC