CVSS 6.5 · Medium EPSS 0,52%
Kerentanan Improper Certificate Validation pada envoyproxy envoy. Skor CVSS 3.1 6.5 (Medium) menurut NVD.
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| envoyproxy | envoy | Semua versi sebelum 1.18.6 |
| envoyproxy | envoy | Versi 1.19.0 hingga sebelum 1.19.3 |
| envoyproxy | envoy | Versi 1.20.0 hingga sebelum 1.20.2 |