Lucene search

MitreCVE-2020-8664

HistoryMar 04, 2020 - 9:15 p.m.

CVE-2020-8664

2020-03-0421:15:11

CWE-287

mitre

web.nvd.nist.gov

cve-2020-8664

cncf

envoy

access control

sds

combined validation context

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

34.7%

JSON

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.

Affected configurations

Nvd

Node

cncfenvoyRange≤1.13.0

VendorProductVersionCPE
cncfenvoy*cpe:2.3:a:cncf:envoy:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cncf	envoy	*	cpe:2.3:a:cncf:envoy::::::::

References

access.redhat.com/errata/RHSA-2020:0734

github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8

www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

34.7%

JSON

Related for CVE-2020-8664