PT-2020-5134 · Cncf · Cncf Envoy

Andon Andonov + 3 · Published 2020-03-04 · Updated 2021-07-21 · CVE-2020-8664

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CNCF Envoy versions 1.13.0 and earlier

Description The issue is related to incorrect Access Control when using SDS with Combined Validation Context in CNCF Envoy. This could lead to the "static" part of the validation context not being applied, even if it is visible in the active config dump, when the same secret (e.g., trusted CA) is used across many resources. The vulnerability may allow a remote attacker to access protected information due to errors in authorization.

Recommendations For CNCF Envoy versions 1.13.0 and earlier, consider updating to a version that addresses the incorrect Access Control issue. As a temporary workaround, restrict the use of the same secret across multiple resources to minimize the risk of exploitation. Additionally, review and adjust the Combined Validation Context configuration to ensure the "static" part of the validation context is properly applied.

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

BDU:2020-05730

CVE-2020-8664

GHSA-3X9M-PGMG-XPX8

RHSA-2020:0734

Affected Products

Cncf Envoy

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-8664 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8664 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0734 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05730 · Security Note
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8 · Note
• https://access.redhat.com/security/cve/cve-2020-8664 · Note
• https://envoyproxy.io/docs/envoy/v1.13.1/intro/version_history · Note
• https://t.me/cvenotify/1337 · Telegram Post