Medium
BIT-envoy-2020-8664
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
Announced Group revision 1
Original source ↗BIT-envoy-2020-8664
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:BIT-envoy-2020-8664
envoy
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.13.0"
}
]
}
],
"package": {
"name": "envoy",
"purl": "pkg:bitnami/envoy",
"ecosystem": "Bitnami"
},
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"database_specific": {
"source": "https://github.com/bitnami/vulndb/tree/main/data/envoy/BIT-envoy-2020-8664.json"
}
}
]- Related CVEs
- CVE-2020-8664
Source reference:
/aliases
Publisher severity
medium
Source reference: /database_specific/severity
- Event
- #84242 · Revision 1
- Added to Heist Feed
- Publisher date