Istio AuthorizationPolicy Incorrect Regex Matching of Dots in serviceAccounts Fields Allows Policy Bypass

Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service account such as cert-manager.io also matches cert-manager-io, cert-managerXio, etc. A DENY rule targeting the same name fails to block those variants. Fixes are available in versions 1.29.2, 1.28.6, and 1.27.9.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

不正确的正则表达式

Istio 安全漏洞

Istio是Istio开源的一套连接、管理和保护微服务的开放平台。 Istio 1.27.9之前版本、1.28.6之前版本和1.29.2之前版本存在安全漏洞，该漏洞源于AuthorizationPolicy中的serviceAccounts和notServiceAccounts字段错误地将点解释为正则表达式匹配器，可能导致访问控制规则被绕过。

N/A

N/A