Vulnerability · Published Mar 4, 2020 · Assigned by mitre

CVE-2020-8664

Medium 5.3

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS NVD)5.3Medium

Exploit odds (30 days)1.3%top 29.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/security/advisories/GHSA-3x9m-pgmg-xpx8 x_refsource_MISC
RHSA-2020:0734 vendor-advisory, x_refsource_REDHAT