CVE-2020-15127: Denial of service in Contour
First published: Wed Aug 05 2020(Updated: )
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flipping the readiness endpoint to false, which removes Envoy from the routing pool. When running Envoy (For example on the host network, pod spec hostNetwork=true), the shutdown manager's endpoint is accessible to anyone on the network that can reach the Kubernetes node that's running Envoy. There is no authentication in place that prevents a rogue actor on the network from shutting down Envoy via the shutdown manager endpoint. Successful exploitation of this issue will lead to bad actors shutting down all instances of Envoy, essentially killing the entire ingress data plane. This is fixed in version 1.7.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Projectcontour Contour Kubernetes | <1.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-15127?
CVE-2020-15127 is a vulnerability in Contour, an Ingress controller for Kubernetes, where a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane.
What is the severity of CVE-2020-15127?
The severity of CVE-2020-15127 is high, with a severity value of 7.5.
How can a bad actor exploit CVE-2020-15127?
A bad actor can exploit CVE-2020-15127 by sending GET requests to /shutdown on port 8090 of the Envoy pod, which initiates Envoy's shutdown procedure, shutting down all instances.
Which versions of Contour are affected by CVE-2020-15127?
Contour versions up to exclusive version 1.7.0 are affected by CVE-2020-15127.
How can CVE-2020-15127 be fixed?
To fix CVE-2020-15127, users should upgrade to Contour version 1.7.0 or later.
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/author
- agent/remedy
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/projectcontour
- canonical/projectcontour contour kubernetes