CVE-2020-8595: High severity Istio Istio vulnerability
A flaw was found in Istio in all versions released after 1.3 (included). The flaw is in Istio's Authentication Policy exact path matching logic and can allow unauthorized access to a HTTP path, even if the path is configured to be only accessed with a valid JWT token.
Other sources
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/istioto a version that resolves this vulnerability.Fixed in 1.3.8 - Upgrade
Upgrade
redhat/istioto a version that resolves this vulnerability.Fixed in 1.4.4 - Upgrade
Upgrade
Istioto a version that resolves this vulnerability.Fixed in 1.3.7 - Upgrade
Upgrade
Istioto a version that resolves this vulnerability.Fixed in 1.4.3 - Compensating control
Review Istio AuthorizationPolicy/AuthenticationPolicy exact-path matching behavior and avoid relying solely on exact-path matching for JWT-protected HTTP endpoints; ensure the policy cannot be bypassed via URI/query syntax such as adding a ? or # character.
Event History
Frequently Asked Questions
What is CVE-2020-8595?
CVE-2020-8595 is a vulnerability in Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 that allows authentication bypass.
What is the severity of CVE-2020-8595?
The severity of CVE-2020-8595 is high, with a severity value of 7.3.
How does CVE-2020-8595 allow authentication bypass?
CVE-2020-8595 allows authentication bypass through the Authentication Policy exact-path matching logic, which can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token.
Which versions of Istio are affected by CVE-2020-8595?
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 are affected by CVE-2020-8595.
How can I fix CVE-2020-8595?
To fix CVE-2020-8595, upgrade to Istio version 1.3.8 or higher if you are using versions 1.3 through 1.3.7, or upgrade to version 1.4.4 or higher if you are using versions 1.4 through 1.4.3.