ubjectAltNames</code> field with a value similar to <code>nested.subdomain.example.com</code> incorrectly accepts a certificate from an upstream peer with a SAN of <code>*.example.com</code>.</p></li></ul><p>The Istio CA, which was formerly known as Citadel, does not issue certificates with DNS wildcard SANs. The vulnerability only impacts configurations that validate externally issued certificates.</p><h2 id=mitigation>Mitigation</h2><ul><li>For Istio 1.5.x deployments: update to <a href=/v1.17/news/releas