by Kastro
Paper/Archive/CVE-2021-3586

CVE-2021-3586

redhat — A flaw was found in servicemesh-operator.

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.7.637 × 2012.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected

ProductAffectedFixed inSource
servicemesh-operatorAffects v2.0.5.1, Fixed in v2.0.5.2.–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1967738refaccess.redhat.com/security/cve/CVE-2021-3586