CVE-2021-3586

moderate-risk

Published 2022-08-22

A flaw was found in servicemesh-operator. The NetworkPolicy resources installed for Maistra do not properly specify which ports may be accessed, allowing access to all ports on these resources from any pod. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Do I need to act?

0.44% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (2)

Openshift Service Mesh

Servicemesh-Operator

Affected Vendors

Redhat

References (4)

Vendor Advisory https://access.redhat.com/security/cve/CVE-2021-3586

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1967738

Vendor Advisory https://access.redhat.com/security/cve/CVE-2021-3586

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1967738

/ 100

moderate-risk

Severity 32/34 · Critical

Exploitability 2/34 · Minimal

Exposure 7/34 · Low