Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23620 State: PUBLISHED Published: 2022-02-09T21:15:12.000Z Last Updated: 2025-04-23T19:05:56.938Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-22 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML export process to contain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are no
tain reference elements containing filesystem syntax like "../", "./". or "/" in general. The referenced elements are not properly escaped. This issue has been resolved in version 13.6-rc-1. This issue can be worked around by limiting or disabling document export. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7ph6-5cmq-xgjq - https://github.com/xwiki/xwiki-platform/commit/ab778254fb8f71c774e1c1239368c44fe3b6bba5 - https://jira.xwiki.org/browse/XWIKI-18819
CVE ID: CVE-2022-23621 State: PUBLISHED Published: 2022-02-09T21:25:11.000Z Last Updated: 2025-04-23T19:05:51.941Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-862 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can read any file located in the XWiki WAR (for example xwiki.cfg and xwiki.properties) through XWiki#invokeServletAndReturnAsString as `$xwiki.invokeServletAndReturnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users a
urnAsString("/WEB-INF/xwiki.cfg")`. This issue has been patched in XWiki versions 12.10.9, 13.4.3 and 13.7-rc-1. Users are advised to update. The only workaround is to limit SCRIPT right. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2jhm-qp48-hv5j - https://github.com/xwiki/xwiki-platform/commit/df8bd49b5a4d87a427002c6535fb5b1746ff117a - https://jira.xwiki.org/browse/XWIKI-18870
CVE ID: CVE-2022-23622 State: PUBLISHED Published: 2022-02-09T21:40:10.000Z Last Updated: 2025-04-23T19:05:46.316Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: xwiki Products: xwiki-platform Problem Types: CWE-79 Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting (XSS) vector in the `registerinline.vm` template related to the `xredirect` hidden field. This template is only used in the following conditions: 1. The wiki must be open to registration for anyone. 2. The wiki must be closed to view for Guest users or more specifically the XWiki.
t be open to registration for anyone. 2. The wiki must be closed to view for Guest users or more specifically the XWiki.Registration page must be forbidden in View for guest user. A way to obtain the second condition is when administrators checked the "Prevent unregistered users from viewing pages, regardless of the page rights" box in the administration rights. This issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. There are two main ways for protecting against this vulnerability, the easiest and the best one is by applying a patch in the `registerinline.vm` template, the patch consists in checking the value of the xredirect field to ensure it matches: `<input type="hidden"
m` template, the patch consists in checking the value of the xredirect field to ensure it matches: `<input type="hidden" name="xredirect" value="$escapetool.xml($!request.xredirect)" />`. If for some reason it's not possible to patch this file, another workaround is to ensure "Prevent unregistered users from viewing pages, regardless of the page rights" is not checked in the rights and apply a better right scheme using groups and rights on spaces. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-gx6h-936c-vrrr - https://github.com/xwiki/xwiki-platform/commit/053d957d53f2a543d158f3ab651e3
m/security/advisories/GHSA-gx6h-936c-vrrr - https://github.com/xwiki/xwiki-platform/commit/053d957d53f2a543d158f3ab651e390d2728e0b9 - https://jira.xwiki.org/browse/XWIKI-19291
CVE ID: CVE-2022-23623 State: PUBLISHED Published: 2022-02-07T22:15:16.000Z Last Updated: 2025-04-23T19:06:51.003Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: frouriojs Products: frourio Problem Types: CWE-20 Description: Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and
is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frouriojs/frourio/security/advisories/GHSA-8xxm-h73r-ghfj - https://github.com/frouriojs/frourio/commit/7c19ac5363305b81b1c6b5232620228763d427af
CVE ID: CVE-2022-23624 State: PUBLISHED Published: 2022-02-07T22:15:10.000Z Last Updated: 2025-04-23T19:06:56.933Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: frouriojs Products: frourio-express Problem Types: CWE-20 Description: Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or late
es in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frouriojs/frourio-express/security/advisories/GHSA-mmj4-777p-fpq9 - https://github.com/frouriojs/frourio-express/commit/73ded5c6f9f1c126c0cb2d05c0505e9e4db142d2
CVE ID: CVE-2022-23625 State: PUBLISHED Published: 2022-03-11T18:00:15.000Z Last Updated: 2025-04-23T18:54:35.233Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: wireapp Products: wire-ios Problem Types: CWE-755 Description: Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifiers may render the iOS Wire Client completely unusable by causing it to repeatedly crash on launch. These malformed resource identifiers can be generated and sent between Wire users. The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsi
The root cause lies in [wireapp/wire-ios-transport](https://github.com/wireapp/wire-ios-transport), where code responsible for removing sensible tokens before logging may fail and lead to a crash (Swift exception) of the application. This causes undesirable behavior, however the (greater) Wire system is still functional. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/wireapp/wire-ios/security/advisories/GHSA-rq36-8qfp-79mc - https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-3xvh-x964-572h - https://github.com/wire
p-79mc - https://github.com/wireapp/wire-ios-transport/security/advisories/GHSA-3xvh-x964-572h - https://github.com/wireapp/wire-ios-transport/commit/02e90aa45edaf7eb2d8b97fa2377cd8104274170
CVE ID: CVE-2022-23626 State: PUBLISHED Published: 2022-02-08T22:00:12.000Z Last Updated: 2025-04-22T18:22:30.382Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: m1k1o Products: blog Problem Types: CWE-20 Description: m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Containe
ade as soon as possible. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/m1k1o/blog/security/advisories/GHSA-wmqj-5v54-24x4 - https://github.com/m1k1o/blog/commit/6f5e59f1401c4a3cf2e518aa85b231ea14e8a2ef - http://packetstormsecurity.com/files/167235/m1k1os-Blog-1.3-Remote-Code-Execution.html
CVE ID: CVE-2022-23627 State: PUBLISHED Published: 2022-02-08T22:30:13.000Z Last Updated: 2025-04-23T19:06:32.535Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: JustArchiNET Products: ArchiSteamFarm Problem Types: CWE-863 Description: ArchiSteamFarm (ASF) is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code, introduced in version V5.2.2.2, the program didn't adequately verify effective access of the user sending proxy (i.e. `[Bots]`) commands. In particular, a proxy-like command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B
ike command sent to bot `A` targeting bot `B` has incorrectly verified user's access against bot `A` - instead of bot `B`, to which the command was originally designated. This in result allowed access to resources beyond those configured, being a security threat affecting confidentiality of other bot instances. A successful attack exploiting this bug requires a significant access granted explicitly by original owner of the ASF process prior to that, as attacker has to control at least a single bot in the process to make use of this inadequate access verification loophole. The issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible. Addi
he issue is patched in ASF V5.2.2.5, V5.2.3.2 and future versions. Users are advised to update as soon as possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-88ch-366c-5m89 - https://github.com/JustArchiNET/ArchiSteamFarm/pull/2501 - https://github.com/JustArchiNET/ArchiSteamFarm/pull/2509 - https://github.com/JustArchiNET/ArchiSteamFarm/commit/7a29d9282bdc3280db2a379c24f73916d786f9b4 - https://github.com/JustArchiNET/ArchiSteamFarm/commit/f807bdb660e75dee5a34994f2ea70970ca6d0492 - https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.2.5 - https://github.com/Just
5a34994f2ea70970ca6d0492 - https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.2.5 - https://github.com/JustArchiNET/ArchiSteamFarm/releases/tag/5.2.3.2
CVE ID: CVE-2022-23628 State: PUBLISHED Published: 2022-02-09T21:50:11.000Z Last Updated: 2025-04-22T18:22:11.535Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: open-policy-agent Products: opa Problem Types: CWE-682 Description: OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree (AST) that contains synthetic nodes could change the logic of some statements by reordering array literals. Example of policies impacted are those that parse and compare web paths. **All of these** three conditions have to be met to create an adverse effect: 1. An AST of Rego had to be **created programmatically**
** three conditions have to be met to create an adverse effect: 1. An AST of Rego had to be **created programmatically** such that it ends up containing terms without a location (such as wildcard variables). 2. The AST had to be **pretty-printed** using the `github.com/open-policy-agent/opa/format` package. 3. The result of the pretty-printing had to be **parsed and evaluated again** via an OPA instance using the bundles, or the Golang packages. If any of these three conditions are not met, you are not affected. Notably, all three would be true if using **optimized bundles**, i.e. bundles created with `opa build -O=1` or higher. In that case, the optimizer would fulfil condition (1.), the re
*, i.e. bundles created with `opa build -O=1` or higher. In that case, the optimizer would fulfil condition (1.), the result of that would be pretty-printed when writing the bundle to disk, fulfilling (2.). When the bundle was then used, we'd satisfy (3.). As a workaround users may disable optimization when creating bundles. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open-policy-agent/opa/security/advisories/GHSA-hcw3-j74m-qc58 - https://github.com/open-policy-agent/opa/pull/3851 - https://github.com/open-policy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239 - https://github.com/open-policy-agent/opa/commit/bfd984dd
icy-agent/opa/commit/932e4ffc37a590ace79e9b75ca4340288c220239 - https://github.com/open-policy-agent/opa/commit/bfd984ddf93ef2c4963a08d4fdadae0bcf1a3717
CVE ID: CVE-2022-23630 State: PUBLISHED Published: 2022-02-10T20:10:09.000Z Last Updated: 2025-04-23T19:05:40.404Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gradle Products: gradle Problem Types: CWE-829 Description: Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled on one or more configurations and those configurations have common dependencies with other configurations that have dependency verification enabled.
s and those configurations have common dependencies with other configurations that have dependency verification enabled. If the configuration that has dependency verification disabled is resolved first, Gradle does not verify the common dependencies for the configuration that has dependency verification enabled. Gradle 7.4 fixes that issue by validating artifacts at least once if they are present in a resolved configuration that has dependency verification active. For users who cannot update either do not use `ResolutionStrategy.disableDependencyVerification()` and do not use plugins that use that method to disable dependency verification for a single configuration or make sure resolution of
se plugins that use that method to disable dependency verification for a single configuration or make sure resolution of configuration that disable that feature do not happen in builds that resolve configuration where the feature is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gradle/gradle/security/advisories/GHSA-9pf5-88jw-3qgr - https://github.com/gradle/gradle/commit/88ab9b652933bc3b2e3161b31ad8b8f4f0516351 - https://docs.gradle.org/7.4/release-notes.html
CVE ID: CVE-2022-23631 State: PUBLISHED Published: 2022-02-09T21:55:10 Last Updated: 2024-08-03T03:51:45.899Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: blitz-js Products: superjson Problem Types: CWE-94 Description: superjson is a program to allow JavaScript expressions to be serialized to a superset of JSON. In versions prior to 1.8.1 superjson allows input to run arbitrary code on any server using superjson input without prior authentication or knowledge. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. Ther
ch uses superjson during request processing. This has been patched in superjson 1.8.1. Users are advised to update. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/blitz-js/superjson/security/advisories/GHSA-5888-ffcr-r425 - https://github.com/advisories/GHSA-5888-ffcr-r425 - https://www.sonarsource.com/blog/blitzjs-prototype-pollution/
CVE ID: CVE-2022-23632 State: PUBLISHED Published: 2022-02-17T14:55:10.000Z Last Updated: 2025-04-23T19:02:55.624Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: traefik Products: traefik Problem Types: CWE-295 Description: Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security (TLS) configuration when the host header is a fully qualified domain name (FQDN). For a request, the TLS configuration choice can be different than the router choice, which implies the use of a wrong TLS configuration. When sending a request using FQDN handled by a router configured with a dedicated TLS configuratio
ng TLS configuration. When sending a request using FQDN handled by a router configured with a dedicated TLS configuration, the TLS configuration falls back to the default configuration that might not correspond to the configured one. If the CNAME flattening is enabled, the selected TLS configuration is the SNI one and the routing uses the CNAME value, so this can skip the expected TLS configuration. Version 2.6.1 contains a patch for this issue. As a workaround, one may add the FDQN to the host rule. However, there is no workaround if the CNAME flattening is enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/s
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/traefik/traefik/security/advisories/GHSA-hrhx-6h34-j5hc - https://github.com/traefik/traefik/pull/8764 - https://github.com/traefik/traefik/releases/tag/v2.6.1 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-23633 State: PUBLISHED Published: 2022-02-11T00:00:00 Last Updated: 2024-08-03T03:51:44.739Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: rails Products: rails Problem Types: CWE-200 Description: Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to wo
requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9 - https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da - http://www.openwall.com/lists/oss-security/2022/02/11/5 - https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html - https://www.debian.org/security/2023/dsa-5372 - https://security.netapp.com/advisory/ntap-20240119-0013/
CVE ID: CVE-2022-23634 State: PUBLISHED Published: 2022-02-11T21:40:11.000Z Last Updated: 2025-04-23T19:05:33.266Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: puma Products: puma Problem Types: CWE-200 Description: Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma
(Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h - https://github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb - https://github.com/advisories/GHSA-rmj8-8hhh-gv5h - https://github.com/advisories/GHSA-wh98-p28r-vrc9 - https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSN
hh-gv5h - https://github.com/advisories/GHSA-wh98-p28r-vrc9 - https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ?utm_medium=email&utm_source=footer&pli=1 - https://www.debian.org/security/2022/dsa-5146 - https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html - https://security.gentoo.org/glsa/202208-28 - https://lists.debian.org/debian-lts-announce/2022/08/msg00015.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUBFJ44NCKJ34LECZRAP4N5VL6USJSIB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/ - https://lists.fedorapro
ives/list/package-announce%40lists.fedoraproject.org/message/L7NESIBFCNSR3XH7LXDPKVMSUBNUB43G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6YWGIIKL7KKTS3ZOAYMYPC7D6WQ5OA5/
CVE ID: CVE-2022-23635 State: PUBLISHED Published: 2022-02-22T22:00:13.000Z Last Updated: 2025-04-23T19:02:00.579Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: istio Products: istio Problem Types: CWE-287 Description: Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reach
012, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet. There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/istio/istio/security/advisories/GHSA-856q-xv
rogram Container: - CISA ADP Vulnrichment: References: - https://github.com/istio/istio/security/advisories/GHSA-856q-xv3c-7f2f - https://github.com/istio/istio/commit/5f3b5ed958ae75156f8656fe7b3794f78e94db84 - https://istio.io/latest/news/security/istio-security-2022-003