PT-2020-15041 · Istio · Istio

Published 2020-04-27 · Updated 2024-08-21 · CVE-2020-1762

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Kiali versions 0.4.0 through 1.15.0

Description The issue is related to insufficient JWT validation, allowing a remote attacker to steal a valid JWT cookie and use it to spoof a user session. This could potentially grant privileges to view and alter the Istio configuration.

Recommendations For Kiali versions 0.4.0 through 1.15.0, update to version 1.15.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the Istio configuration to minimize the risk of exploitation.

Fix

Session Fixation

Improper Certificate Validation

Insufficient Session Expiration

Weakness Enumeration

CWE-384

CWE-295

CWE-613

Related Identifiers

CVE-2020-1762

GHSA-465W-GG5P-85C9

GO-2022-0626

RHSA-2020:0972

Affected Products

Istio

References · 11

• https://osv.dev/vulnerability/GO-2022-0626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1762 · Security Note
• https://osv.dev/vulnerability/GHSA-465w-gg5p-85c9 · Vendor Advisory
• https://kiali.io/news/security-bulletins/kiali-security-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1762 · Vendor Advisory
• https://github.com/kiali/kiali/commit/93f5cd0b6698e8fe8772afb8f35816f6c086aef1 · Note
• https://github.com/kiali/kiali/commit/c91a0949683976f621cca213c1193831d63b381c · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1762 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1810387 · Note
• https://t.me/cvenotify/3291 · Telegram Post
• https://github.com/advisories/GHSA-465w-gg5p-85c9 · Note