What is CVE-2021-3586?

CVE-2021-3586 is a critical-severity vulnerability in Redhat Openshift_service_mesh, classified under Initialization of a Resource with an Insecure Default. CVSS score: 9.8/10. Published 2022-08-22.

How severe is CVE-2021-3586?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Redhat Openshift_service_mesh

CVE-2021-3586

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vul…

EPSS: 0.009 (55.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Redhat Openshift_service_mesh — versions 2.0
Redhat Servicemesh-operator — versions 2.0.5.1
N/a Servicemesh-operator — versions Affects v2.0.5.1, Fixed in v2.0.5.2.

Weakness classification (CWE)

CWE-1188 — Initialization of a Resource with an Insecure Default

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)
secalert@redhat.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-3586?: CVE-2021-3586 is a critical-severity vulnerability in Redhat Openshift_service_mesh, classified under Initialization of a Resource with an Insecure Default. CVSS score: 9.8/10. Published 2022-08-22.
How severe is CVE-2021-3586?: Critical severity. CVSS v3 base score is 9.8 out of 10.