CVE-2020-8664

envoy: Incorrect Access Control when using SDS with Combined Validation Context

Severity Score

5.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.

CNCF Envoy versiones hasta 1.13.0, presenta un Control de Acceso incorrecto cuando se usa SDS con Contexto de Comprobación Combinada. Al utilizar el mismo secreto (por ejemplo, CA de confianza) a través de muchos recursos junto con el contexto de comprobación combinado podría conllevar a que la parte “static” del contexto de comprobación no sea aplicada, aún y cuando fuera visible en el volcado de la configuración activa.

An access control bypass vulnerability was found in envoy. When the same TLS secret is used across multiple resources, the client's data, such as the subject alternative name or hash, is not validated. This flaw could lead to a possible bypass of security restrictions.

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation. Issues addressed include a bypass vulnerability.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-02-06 CVE Reserved
2020-03-04 CVE Published
2024-08-04 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-284: Improper Access Control
CWE-287: Improper Authentication

CAPEC

References (5)

URL	Tag	Source
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8	Third Party Advisory
https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history	Release Notes

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2020:0734	2021-07-21
https://access.redhat.com/security/cve/CVE-2020-8664	2020-03-05
https://bugzilla.redhat.com/show_bug.cgi?id=1802542	2020-03-05

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cncf Search vendor "Cncf"		Envoy Search vendor "Cncf" for product "Envoy"				<= 1.13.0 Search vendor "Cncf" for product "Envoy" and version " <= 1.13.0"		-		Affected