| Package | Affected versions | Patched versions |
|---|---|---|
| istio.io/istio | ≥ 1.1.0, < 1.1.7 | 1.1.7 |
| istio | ≥ 1.1, ≤ 1.1.6 |
Istio 1.1.x through 1.1.6 has Incorrect Access Control. When disablePolicyChecks is set to false, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.
This behavior is a result of a change to istio/pilot/pkg/networking/plugin/mixer/mixer.go in 1.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free