CVE-2020-8660

{"id": "CVE-2020-8660", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-03-04T22:15:11.343", "references": [{"url": "https://access.redhat.com/errata/RHSA-2020:0734", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-c4g8-7grc-5wvx", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.envoyproxy.io/docs/envoy/v1.13.1/intro/version_history", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process."}, {"lang": "es", "value": "Una omisi\u00f3n del inspector TLS de CNCF Envoy versiones hasta 1.13.0. El inspector TLS podr\u00eda haber sido omitido (no reconocido como cliente TLS) por un cliente que usa solo TLS versi\u00f3n 1.3. Debido a que las extensiones TLS (SNI, ALPN) no fueron inspeccionadas, esas conexiones podr\u00edan haber coincidido con una cadena de filtro err\u00f3nea, posiblemente omitiendo algunas restricciones de seguridad en el proceso."}], "lastModified": "2020-07-13T17:03:27.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FAC4665-B4CC-4C2F-AD63-6036A2DFD03A", "versionEndExcluding": "1.12.3"}, {"criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BAF9778-93D0-4D9F-8BD3-B81AB423155F", "versionEndExcluding": "1.13.1", "versionStartIncluding": "1.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}