Istio 1.4.9 and 1.5.3 have been released. The release notes for Istio 1.4.9 are here: https://istio.io/news/releases/1.4.x/announcing-1.4.9 and the release notes for 1.5.3 are here: https://istio.io/news/releases/1.5.x/announcing-1.5.3/. Please note that these releases contain fixes for the CVE discussed here: https://istio.io/news/security/istio-security-2020-005 as well as several bug fixes that you can read about in the 1.5.3 release notes.
DO NOT USE Istio 1.5.3. USE release 1.5.4 instead. Due to a publishing error, the 1.5.3 images do not contain the fix for CVE-2020-10739 as claimed in the original announcement.