Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 198

Export CSV
CVE-2020-25017

envoyproxy/envoy: incorrectly handles multiple HTTP headers in requests

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy’s setCopy() header map API does not replace all existing occurences of a non-inline header.

CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-1764

kiali: JWT cookie uses default signing key

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

CVSS 3.1 · 8.6 High EPSS 3.5% KEV · Not listed
Vendors
Kiali Redhat
Products
Kiali Openshift Service Mesh Service Mesh
CVE-2020-1762

kiali: ignoring JWT claim fields

An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using that to spoof a user session, possibly gaining privileges to view and alter the Istio configuration.

CVSS 3.1 · 7 High EPSS 1.2% KEV · Not listed
Vendors
Kiali Redhat
Products
Kiali Openshift Service Mesh Service Mesh
CVE-2020-1704

openshift-service-mesh/kiali-rhel7-operator: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openshift Service Mesh Service Mesh
CVE-2020-16845

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 2 more
Products
Debian Linux Fedora Go and 10 more
CVE-2020-16844

istio: incorrect translation of DENY policy for TCP service

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.

CVSS 3.1 · 6.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Istio Redhat
Products
Istio Service Mesh
CVE-2020-15586

golang: data race in certain net/http servers including ReverseProxy can lead to DoS

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Cloudfoundry Debian Fedoraproject and 3 more
Products
Cf-deployment Routing-release Debian Linux and 12 more
CVE-2020-15104

TLS Validation Vulnerability in Envoy

In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-14306

openshift-service-mesh/istio-rhel8-operator: control plane can deploy gateway image to any namespace

An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level of access to the cluster to deploy a custom gateway/pod to any namespace, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Istio-operator Project Redhat
Products
Istio-operator Service Mesh
CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Text 3scale Amp and 13 more
CVE-2020-13379

grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

CVSS 3.1 · 8.2 High EPSS 99.9% KEV · Not listed
Vendors
Fedoraproject Grafana Netapp and 2 more
Products
Fedora Grafana E-series Performance Analyzer and 8 more
CVE-2020-12605

envoy: Resource exhaustion when processing HTTP/1.1 headers with long field names

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-12604

envoy: Resource exhaustion via HTTP/2 client requests with large payloads and improper stream windows

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-12603

envoy: Resource exhaustion when proxying HTTP/2 requests or responses with small data frames

Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Envoyproxy Redhat
Products
Envoy Service Mesh
CVE-2020-12459

grafana: information disclosure through world-readable grafana configuration files

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Grafana Redhat
Products
Fedora Grafana Enterprise Linux and 1 more