CVE-2020-8664: Medium severity CNCF Envoy vulnerability
A vulnerability was found in Envoy, where using SDS with Combined Validation Context Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
Other sources
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.13.1 - Upgrade
Upgrade
CNCF Envoyto a version that resolves this vulnerability.Fixed in 1.13.0 - Compensating control
Avoid using SDS with Combined Validation Context that reuses the same secret (e.g., a trusted CA) across many resources, since this could prevent the “static” part of the validation context from being applied.
Event History
Frequently Asked Questions
What is CVE-2020-8664?
CVE-2020-8664 is a vulnerability in CNCF Envoy, versions up to 1.13.0, that allows incorrect Access Control when using SDS with Combined Validation Context.
What is the severity of CVE-2020-8664?
CVE-2020-8664 has a severity value of 5.3, which is considered medium.
How does CVE-2020-8664 impact CNCF Envoy?
CVE-2020-8664 can lead to the 'static' part of the validation context not being applied, causing incorrect Access Control when using SDS with Combined Validation Context.
How can I fix CVE-2020-8664?
To fix CVE-2020-8664, update CNCF Envoy to version 1.13.1 or higher.
Where can I find more information about CVE-2020-8664?
You can find more information about CVE-2020-8664 in the Red Hat advisory [RHSA-2020:0734](https://access.redhat.com/errata/RHSA-2020:0734) and the Envoy security advisory [GHSA-3x9m-pgmg-xpx8](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8)