CVE-2022-21679

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Istio is an open platform to connect, manage, and secure microservices. In Istio 1.12.0 and 1.12.1 The authorization policy with hosts and notHosts might be accidentally bypassed for ALLOW action or rejected unexpectedly for DENY action during the upgrade from 1.11 to 1.12.0/1.12.1. Istio 1.12 supports the hosts and notHosts fields in authorization policy with a new Envoy API shipped with the 1.12 data plane. A bug in the 1.12.0 and 1.12.1 incorrectly uses the new Envoy API with the 1.11 data plane. This will cause the hosts and notHosts fields to be always matched regardless of the actual value of the host header when mixing 1.12.0/1.12.1 control plane and 1.11 data plane. Users are advised to upgrade or to not mix the 1.12.0/1.12.1 control plane with 1.11 data plane if using hosts or notHosts field in authorization policy.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-670

Affected software

No affected versions have been published.

Timeline

Published
Jan 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-21686.1The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the historyCVE-2022-216807.5Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking agCVE-2022-216817.5Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backCVE-2022-216826.5Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.CVE-2022-216834.3Wagtail is a Django based content management system focused on flexibility and user experience. When notifications for new replies in commenCVE-2022-216848.8Discourse is an open source discussion platform. Versions prior to 2.7.13 in `stable`, 2.8.0.beta11 in `beta`, and 2.8.0.beta11 in `tests-paCVE-2022-216856.5Frontier is Substrate's Ethereum compatibility layer. Prior to commit number `8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664`, a bug in Frontier'sCVE-2022-216869.8PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to injeCVE-2022-216876.5gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerabilCVE-2022-216885.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-216897.5OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor netCVE-2022-21694.8The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admi
CVE-2022-21679: Critical severity, CVSS 9.8 | Vulnix