Announcing Istio 1.15.2

This release contains a fix for CVE-2022-39278 and bug fixes to improve robustness. This release note describes what is different between Istio 1.15.1 and Istio 1.15.2.

FYI, This release includes security fixes in Go 1.19.2 (released 2022-10-04) for the archive/tar, net/http/httputil, and regexp packages.

{{< relnote >}}

Changes

• Fixed an issue that the default idleTimeout for the passthrough cluster was changed to 0s in 1.14.0, disabling the timeout. Restored the previous behavior to using Envoy's default value of 1 hour. (Issue #41114)

• Fixed the gateway API integration to not fail when the v1alpha2 version is removed.

• Fixed handling of deprecated autoscaling settings. (Issue #41011)