CVE-2020-16844: Medium severity istio vulnerability
Published Oct 1, 2020
·Updated
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. -some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
Affected Software
4 affected componentsFixes available
go/istio.io/istio>=1.6.0<1.6.8
1.6.8
go/istio.io/istio>=1.5.0<1.5.9
1.5.9
Istio Istio>=1.5.0<=1.5.8
Istio Istio>=1.6.0<=1.6.7
Event History
Oct 1, 2020
CVE Published
via MITRE·04:32 PM
Data Sourced
via MITRE·04:32 PM
Description
Feb 15, 2022
Advisory Published
01:57 AM
Frequently Asked Questions
1
What is the severity of CVE-2020-16844?
The severity of CVE-2020-16844 is medium with a CVSS score of 6.8.
2
How can I fix CVE-2020-16844?
To fix CVE-2020-16844, upgrade Istio to version 1.5.9 or 1.6.8, depending on the currently installed version.
3
Which versions of Istio are affected by CVE-2020-16844?
Istio versions 1.5.0 through 1.5.8 and 1.6.0 through 1.6.7 are affected by CVE-2020-16844.
4
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2020-16844.
5
What is the CWE of CVE-2020-16844?
The CWE of CVE-2020-16844 is CWE-284.