CVE-2020-15104

{"id": "CVE-2020-15104", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2020-07-14T22:15:10.937", "references": [{"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-346"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-346"}]}], "descriptions": [{"lang": "en", "value": "In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0."}, {"lang": "es", "value": "En Envoy versiones anteriores a 1.12.6, 1.13.4, 1.14.4 y 1.15.0, cuando se comprueban los certificados TLS, Envoy permitir\u00eda incorrectamente aplicar un DNS Subject Alternative Name comod\u00edn a m\u00faltiples subdominios. Por ejemplo, con una SAN de *.example.com, Envoy permitir\u00eda incorrectamente el nested.subdomain.example.com, cuando solo deber\u00eda permitir el subdomain.example.com. Este fallo aplica para ambos comprobaciones de un certificado TLS del cliente en mTLS y a la comprobaci\u00f3n de un certificado TLS del servidor para conexiones anteriores. Esta vulnerabilidad solo es aplicable a situaciones en las que una entidad no confiable puede obtener un certificado TLS comod\u00edn firmado para un dominio en el que solo desea confiar en un subdominio. Por ejemplo, si tiene la intenci\u00f3n de confiar en api.mysubdomain.example.com, y un actor no confiable puede obtener un certificado TLS firmado para *.example.com o *.com. Las configuraciones son vulnerables si usan verify_subject_alt_name en cualquier versi\u00f3n de Envoy, o si usan match_subject_alt_names en la versi\u00f3n 1.14 o posteriores. Este problema ha sido corregido en las versiones de Envoy 1.12.6, 1.13.4, 1.14.4, 1.15.0"}], "lastModified": "2024-11-21T05:04:49.137", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40CF9EE0-3EFC-4E23-9E96-6860686D68F9", "versionEndExcluding": "1.12.6"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03F35E43-8693-4A3F-BBCD-BF71498D5607", "versionEndExcluding": "1.13.4", "versionStartIncluding": "1.13.0"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B80A633C-5843-4229-A733-30C7B366AC57", "versionEndExcluding": "1.14.4", "versionStartIncluding": "1.14.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}