Skip to content

Commit 2a235c0

Browse files
JSticklerJStickler
committed
OSSMDOC-400: Release Notes for 1.1.17.1/2.0.7.1 release.
1 parent 0d82dce commit 2a235c0

6 files changed

+154
-22
lines changed

‎modules/ossm-rn-fixed-issues-1x.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ Module included in the following assemblies:
88

99
////
1010
Provide the following info for each issue if possible:
11-
Consequence - What user action or situation would make this problem appear (If you have the foo option enabled and did x)? What did the customer experience as a result of the issue? What was the symptom?
12-
Cause - Why did this happen?
13-
Fix - What did we change to fix the problem?
14-
Result - How has the behavior changed as a result? Try to avoid “It is fixed” or “The issue is resolved” or “The error no longer presents”.
11+
*Consequence* - What user action or situation would make this problem appear (If you have the foo option enabled and did x)? What did the customer experience as a result of the issue? What was the symptom?
12+
*Cause* - Why did this happen?
13+
*Fix* - What did we change to fix the problem?
14+
*Result* - How has the behavior changed as a result? Try to avoid “It is fixed” or “The issue is resolved” or “The error no longer presents”.
1515
////
1616

1717
The following issues been resolved in the current release:

‎modules/ossm-rn-fixed-issues.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ Module included in the following assemblies:
88

99
////
1010
Provide the following info for each issue if possible:
11-
Consequence - What user action or situation would make this problem appear (If you have the foo option enabled and did x)? What did the customer experience as a result of the issue? What was the symptom?
12-
Cause - Why did this happen?
13-
Fix - What did we change to fix the problem?
14-
Result - How has the behavior changed as a result? Try to avoid “It is fixed” or “The issue is resolved” or “The error no longer presents”.
11+
*Consequence* - What user action or situation would make this problem appear (If you have the foo option enabled and did x)? What did the customer experience as a result of the issue? What was the symptom?
12+
*Cause* - Why did this happen?
13+
*Fix* - What did we change to fix the problem?
14+
*Result* - How has the behavior changed as a result? Try to avoid “It is fixed” or “The issue is resolved” or “The error no longer presents”.
1515
////
1616

1717
The following issues been resolved in the current release:

‎modules/ossm-rn-known-issues-1x.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ Module included in the following assemblies:
77
= Known issues
88

99
////
10-
Consequence - What user action or situation would make this problem appear (Selecting the Foo option with the Bar version 1.3 plugin enabled results in an error message)? What did the customer experience as a result of the issue? What was the symptom?
11-
Cause (if it has been identified) - Why did this happen?
12-
Workaround (If there is one)- What can you do to avoid or negate the effects of this issue in the meantime? Sometimes if there is no workaround it is worthwhile telling readers to contact support for advice. Never promise future fixes.
13-
Result - If the workaround does not completely address the problem.
10+
*Consequence* - What user action or situation would make this problem appear (Selecting the Foo option with the Bar version 1.3 plugin enabled results in an error message)? What did the customer experience as a result of the issue? What was the symptom?
11+
*Cause* (if it has been identified) - Why did this happen?
12+
*Workaround* (If there is one)- What can you do to avoid or negate the effects of this issue in the meantime? Sometimes if there is no workaround it is worthwhile telling readers to contact support for advice. Never promise future fixes.
13+
*Result* - If the workaround does not completely address the problem.
1414
////
1515

1616
These limitations exist in {ProductName}:

‎modules/ossm-rn-known-issues.adoc

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ Module included in the following assemblies:
77
= Known issues
88

99
////
10-
Consequence - What user action or situation would make this problem appear (Selecting the Foo option with the Bar version 1.3 plugin enabled results in an error message)? What did the customer experience as a result of the issue? What was the symptom?
11-
Cause (if it has been identified) - Why did this happen?
12-
Workaround (If there is one)- What can you do to avoid or negate the effects of this issue in the meantime? Sometimes if there is no workaround it is worthwhile telling readers to contact support for advice. Never promise future fixes.
13-
Result - If the workaround does not completely address the problem.
10+
*Consequence* - What user action or situation would make this problem appear (Selecting the Foo option with the Bar version 1.3 plugin enabled results in an error message)? What did the customer experience as a result of the issue? What was the symptom?
11+
*Cause* (if it has been identified) - Why did this happen?
12+
*Workaround* (If there is one)- What can you do to avoid or negate the effects of this issue in the meantime? Sometimes if there is no workaround it is worthwhile telling readers to contact support for advice. Never promise future fixes.
13+
*Result* - If the workaround does not completely address the problem.
1414
////
1515

1616
These limitations exist in {ProductName}:

‎modules/ossm-rn-new-features-1x.adoc

Lines changed: 59 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ Module included in the following assemblies:
77
= New Features
88

99
////
10-
Feature – Describe the new functionality available to the customer. For enhancements, try to describe as specifically as possible where the customer will see changes.
11-
Reason – If known, include why has the enhancement been implemented (use case, performance, technology, etc.). For example, showcases integration of X with Y, demonstrates Z API feature, includes latest framework bug fixes. There may not have been a 'problem' previously, but system behaviour may have changed.
12-
Result – If changed, describe the current user experience
10+
*Feature* – Describe the new functionality available to the customer. For enhancements, try to describe as specifically as possible where the customer will see changes.
11+
*Reason* – If known, include why has the enhancement been implemented (use case, performance, technology, etc.). For example, showcases integration of X with Y, demonstrates Z API feature, includes latest framework bug fixes. There may not have been a 'problem' previously, but system behavior may have changed.
12+
*Result* – If changed, describe the current user experience
1313
////
1414
{ProductName} provides a number of key capabilities uniformly across a network of services:
1515

@@ -36,6 +36,62 @@ Result – If changed, describe the current user experience
3636
|1.0.0
3737
|===
3838

39+
40+
== New features {ProductName} 1.1.17.1
41+
42+
This release of {ProductName} addresses Common Vulnerabilities and Exposures (CVEs).
43+
44+
=== Change in how {ProductName} handles URI fragments
45+
46+
{ProductName} contains a remotely exploitable vulnerability, link:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39156[CVE-2021-39156], where an HTTP request with a fragment (a section in the end of a URI that begins with a # character) in the URI path could bypass the Istio URI path-based authorization policies. For instance, an Istio authorization policy denies requests sent to the URI path `/user/profile`. In the vulnerable versions, a request with URI path `/user/profile#section1` bypasses the deny policy and routes to the backend (with the normalized URI `path /user/profile%23section1`), possibly leading to a security incident.
47+
48+
You are impacted by this vulnerability if you use authorization policies with DENY actions and `operation.paths`, or ALLOW actions and `operation.notPaths`.
49+
50+
With the mitigation, the fragment part of the request’s URI is removed before the authorization and routing. This prevents a request with a fragment in its URI from bypassing authorization policies which are based on the URI without the fragment part.
51+
52+
=== Required update for authorization policies
53+
54+
Istio generates hostnames for both the hostname itself and all matching ports. For instance, a virtual service or Gateway for a host of "httpbin.foo" generates a config matching "httpbin.foo and httpbin.foo:*". However, exact match authorization policies only match the exact string given for the `hosts` or `notHosts` fields.
55+
56+
Your cluster is impacted if you have `AuthorizationPolicy` resources using exact string comparison for the rule to determine link:https://istio.io/latest/docs/reference/config/security/authorization-policy/#Operation[hosts or notHosts].
57+
58+
You must update your authorization policy link:https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule[rules] to use prefix match instead of exact match. For example, replacing `hosts: ["httpbin.com"]` with `hosts: ["httpbin.com:*"]` in the first `AuthorizationPolicy` example.
59+
60+
.First example AuthorizationPolicy using prefix match
61+
[source,yaml]
62+
----
63+
apiVersion: security.istio.io/v1beta1
64+
kind: AuthorizationPolicy
65+
metadata:
66+
name: httpbin
67+
namespace: foo
68+
spec:
69+
action: DENY
70+
rules:
71+
- from:
72+
- source:
73+
namespaces: ["dev"]
74+
to:
75+
- operation:
76+
hosts: [“httpbin.com”,"httpbin.com:*"]
77+
----
78+
79+
.Second example AuthorizationPolicy using prefix match
80+
[source,yaml]
81+
----
82+
apiVersion: security.istio.io/v1beta1
83+
kind: AuthorizationPolicy
84+
metadata:
85+
name: httpbin
86+
namespace: default
87+
spec:
88+
action: DENY
89+
rules:
90+
- to:
91+
- operation:
92+
hosts: ["httpbin.example.com:*"]
93+
----
94+
3995
== New features {ProductName} 1.1.17
4096

4197
This release of {ProductName} addresses Common Vulnerabilities and Exposures (CVEs) and bug fixes.

‎modules/ossm-rn-new-features.adoc

Lines changed: 79 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ Module included in the following assemblies:
77
= New features
88

99
////
10-
Feature – Describe the new functionality available to the customer. For enhancements, try to describe as specifically as possible where the customer will see changes.
11-
Reason – If known, include why has the enhancement been implemented (use case, performance, technology, etc.). For example, showcases integration of X with Y, demonstrates Z API feature, includes latest framework bug fixes. There may not have been a 'problem' previously, but system behavior may have changed.
12-
Result – If changed, describe the current user experience
10+
*Feature* – Describe the new functionality available to the customer. For enhancements, try to describe as specifically as possible where the customer will see changes.
11+
*Reason* – If known, include why has the enhancement been implemented (use case, performance, technology, etc.). For example, showcases integration of X with Y, demonstrates Z API feature, includes latest framework bug fixes. There may not have been a 'problem' previously, but system behavior may have changed.
12+
*Result* – If changed, describe the current user experience
1313
////
1414
{ProductName} provides a number of key capabilities uniformly across a network of services:
1515

@@ -36,6 +36,82 @@ Result – If changed, describe the current user experience
3636
|2.0.0
3737
|===
3838

39+
== New features {ProductName} 2.0.7.1
40+
41+
This release of {ProductName} addresses Common Vulnerabilities and Exposures (CVEs).
42+
43+
=== Change in how {ProductName} handles URI fragments
44+
45+
{ProductName} contains a remotely exploitable vulnerability, link:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39156[CVE-2021-39156], where an HTTP request with a fragment (a section in the end of a URI that begins with a # character) in the URI path could bypass the Istio URI path-based authorization policies. For instance, an Istio authorization policy denies requests sent to the URI path `/user/profile`. In the vulnerable versions, a request with URI path `/user/profile#section1` bypasses the deny policy and routes to the backend (with the normalized URI `path /user/profile%23section1`), possibly leading to a security incident.
46+
47+
You are impacted by this vulnerability if you use authorization policies with DENY actions and `operation.paths`, or ALLOW actions and `operation.notPaths`.
48+
49+
With the mitigation, the fragment part of the request’s URI is removed before the authorization and routing. This prevents a request with a fragment in its URI from bypassing authorization policies which are based on the URI without the fragment part.
50+
51+
To opt-out from the new behavior in the mitigation, the fragment section in the URI will be kept. You can configure your `ServiceMeshControlPlane` to keep URI fragments.
52+
53+
[WARNING]
54+
====
55+
Disabling the new behavior will normalize your paths as described above and is considered unsafe. Ensure that you have accommodated for this in any security policies before opting to keep URI fragments.
56+
====
57+
58+
.Example `ServiceMeshControlPlane` modification
59+
[source,yaml]
60+
----
61+
apiVersion: maistra.io/v2
62+
kind: ServiceMeshControlPlane
63+
metadata:
64+
name: basic
65+
spec:
66+
techPreview:
67+
meshConfig:
68+
defaultConfig:
69+
proxyMetadata: HTTP_STRIP_FRAGMENT_FROM_PATH_UNSAFE_IF_DISABLED: "false"
70+
----
71+
72+
=== Required update for authorization policies
73+
74+
Istio generates hostnames for both the hostname itself and all matching ports. For instance, a virtual service or Gateway for a host of "httpbin.foo" generates a config matching "httpbin.foo and httpbin.foo:*". However, exact match authorization policies only match the exact string given for the `hosts` or `notHosts` fields.
75+
76+
Your cluster is impacted if you have `AuthorizationPolicy` resources using exact string comparison for the rule to determine link:https://istio.io/latest/docs/reference/config/security/authorization-policy/#Operation[hosts or notHosts].
77+
78+
You must update your authorization policy link:https://istio.io/latest/docs/reference/config/security/authorization-policy/#Rule[rules] to use prefix match instead of exact match. For example, replacing `hosts: ["httpbin.com"]` with `hosts: ["httpbin.com:*"]` in the first `AuthorizationPolicy` example.
79+
80+
.First example AuthorizationPolicy using prefix match
81+
[source,yaml]
82+
----
83+
apiVersion: security.istio.io/v1beta1
84+
kind: AuthorizationPolicy
85+
metadata:
86+
name: httpbin
87+
namespace: foo
88+
spec:
89+
action: DENY
90+
rules:
91+
- from:
92+
- source:
93+
namespaces: ["dev"]
94+
to:
95+
- operation:
96+
hosts: [“httpbin.com”,"httpbin.com:*"]
97+
----
98+
99+
.Second example AuthorizationPolicy using prefix match
100+
[source,yaml]
101+
----
102+
apiVersion: security.istio.io/v1beta1
103+
kind: AuthorizationPolicy
104+
metadata:
105+
name: httpbin
106+
namespace: default
107+
spec:
108+
action: DENY
109+
rules:
110+
- to:
111+
- operation:
112+
hosts: ["httpbin.example.com:*"]
113+
----
114+
39115
== New features {ProductName} 2.0.7
40116

41117
This release of {ProductName} addresses Common Vulnerabilities and Exposures (CVEs) and bug fixes.

0 commit comments

Comments
 (0)