CVE-2021-34824 log

Source
Severity Critical
Remote Yes
Type Information disclosure
Description 
Istio before version 1.10.2 contains a remotely exploitable vulnerability where credentials specified in the Gateway and DestinationRule credentialName field can be accessed from different namespaces.

The Istio Gateway and DestinationRule can load private keys and certificates from Kubernetes secrets via the credentialName configuration. For Istio 1.8 and above, the secrets are conveyed from Istiod to gateways or workloads via the XDS API.

In the above approach, a gateway or workload deployment should only be able to access credentials (TLS certificates and private keys) stored in the Kubernetes secrets within its namespace. However, a bug in Istiod permits an authorized client the ability to access and retrieve any TLS certificate and private key cached in Istiod.
Group Package Affected Fixed Severity Status Ticket
AVG-2113 istio 1.10.1-1 1.10.2-1 Critical Fixed
Date Advisory Group Package Severity Type
01 Jul 2021 ASA-202107-3 AVG-2113 istio Critical information disclosure
References 
https://istio.io/latest/news/security/istio-security-2021-007/
https://github.com/istio/istio/commit/10674c9a86ece93dcd40efd8e4b9147bc8604460
https://github.com/istio/istio/commit/f58f789f8e0d1580d00b68b76b1132163939b9ef
Notes 
Workaround
==========

This vulnerability can be mitigated by disabling Istiod caching. Caching is disabled by setting an Istiod environment variable PILOT_ENABLE_XDS_CACHE=false. System and Istiod performance may be impacted as this disables XDS caching.