PT-2020-14187 · Envoy · Envoy

Yann-Soubeyrand · Published 2020-07-14 · Updated 2024-03-06 · CVE-2020-15104

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.12.6 Envoy versions prior to 1.13.4 Envoy versions prior to 1.14.4 Envoy versions prior to 1.15.0

Description The issue arises when validating TLS certificates, where Envoy incorrectly allows a wildcard DNS Subject Alternative Name to apply to multiple subdomains. This defect affects both client TLS certificate validation in mTLS and server TLS certificate validation for upstream connections. The vulnerability is applicable in situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. Configurations using verify subject alt name in any Envoy version or match subject alt names in version 1.14 or later are vulnerable.

Recommendations For versions prior to 1.12.6, update to version 1.12.6 or later. For versions prior to 1.13.4, update to version 1.13.4 or later. For versions prior to 1.14.4, update to version 1.14.4 or later. For versions prior to 1.15.0, update to version 1.15.0 or later.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BIT-ENVOY-2020-15104

CVE-2020-15104

GHSA-W5F5-6QHQ-HHRG

RHSA-2020:3090

Affected Products

Envoy

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-15104 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15104 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-envoy-2020-15104 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5765.html · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg · Note