istioctl-1.27.3-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16717 Final 1 1 2025-10-21T00:00:00Z current 2025-10-21T00:00:00Z 2025-10-21T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z istioctl-1.27.3-1.1 on GA media These are all security issues fixed in the istioctl-1.27.3-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16717 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-62409/ SUSE CVE CVE-2025-62409 page https://www.suse.com/security/cve/CVE-2025-62504/ SUSE CVE CVE-2025-62504 page openSUSE Tumbleweed istioctl-1.27.3-1.1 istioctl-bash-completion-1.27.3-1.1 istioctl-zsh-completion-1.27.3-1.1 istioctl-1.27.3-1.1 as a component of openSUSE Tumbleweed istioctl-bash-completion-1.27.3-1.1 as a component of openSUSE Tumbleweed istioctl-zsh-completion-1.27.3-1.1 as a component of openSUSE Tumbleweed Envoy is a cloud-native, open source edge and service proxy. Prior to 1.36.1, 1.35.5, 1.34.9, and 1.33.10, large requests and responses can potentially trigger TCP connection pool crashes due to flow control management in Envoy. It will happen when the connection is closing but upstream data is still coming, resulting in a buffer watermark callback nullptr reference. The vulnerability impacts TCP proxy and HTTP 1 & 2 mixed use cases based on ALPN. This vulnerability is fixed in 1.36.1, 1.35.5, 1.34.9, and 1.33.10. CVE-2025-62409 openSUSE Tumbleweed:istioctl-1.27.3-1.1 openSUSE Tumbleweed:istioctl-bash-completion-1.27.3-1.1 openSUSE Tumbleweed:istioctl-zsh-completion-1.27.3-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-62409.html CVE-2025-62409 Envoy is an open source edge and service proxy. Envoy versions earlier than 1.36.2, 1.35.6, 1.34.10, and 1.33.12 contain a use-after-free vulnerability in the Lua filter. When a Lua script executing in the response phase rewrites a response body so that its size exceeds the configured per_connection_buffer_limit_bytes (default 1MB), Envoy generates a local reply whose headers override the original response headers, leaving dangling references and causing a crash. This results in denial of service. Updating to versions 1.36.2, 1.35.6, 1.34.10, or 1.33.12 fixes the issue. Increasing per_connection_buffer_limit_bytes (and for HTTP/2 the initial_stream_window_size) or increasing per_request_buffer_limit_bytes / request_body_buffer_limit can reduce the likelihood of triggering the condition but does not correct the underlying memory safety flaw. CVE-2025-62504 openSUSE Tumbleweed:istioctl-1.27.3-1.1 openSUSE Tumbleweed:istioctl-bash-completion-1.27.3-1.1 openSUSE Tumbleweed:istioctl-zsh-completion-1.27.3-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-62504.html CVE-2025-62504