PT-2020-5141 · Cncf · Envoy

Turbotankist · Published 2020-03-04 · Updated 2024-03-06 · CVE-2020-8660

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CNCF Envoy versions prior to 1.13.0

Description The issue is related to insufficient authentication of data in the Envoy network software. It allows a remote attacker to bypass security restrictions by using only TLS 1.3, which could lead to unauthorized access to protected information. The TLS inspector could be bypassed, and connections might be matched to the wrong filter chain, potentially bypassing some security restrictions.

Recommendations For versions prior to 1.13.0, update to version 1.13.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of TLS 1.3 until a patch is available. Restrict access to the TLS inspector to minimize the risk of exploitation. Avoid using the TLS extensions (SNI, ALPN) in the affected connections until the issue is resolved.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2020-05737

BIT-ENVOY-2020-8660

CVE-2020-8660

GHSA-C4G8-7GRC-5WVX

RHSA-2020:0734

Affected Products

Envoy

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-8660 · Security Note
• https://bdu.fstec.ru/vul/2020-05737 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2020-8660 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8660 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2020:0734 · Vendor Advisory
• https://envoyproxy.io/docs/envoy/v1.13.1/intro/version_history · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-c4g8-7grc-5wvx · Note
• https://t.me/cvenotify/1340 · Telegram Post
• https://access.redhat.com/security/cve/cve-2020-8660 · Note