Description

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.

Remediation

References

CVE-2020-8660

Related Vulnerabilities

WordPress Plugin Maps Widget for Google Maps-Google Maps Builder Security Bypass (4.16)

WordPress Plugin Toolset Types-Custom Post Types, Custom Fields and Taxonomies Privilege Escalation (2.3.3)

Drupal Improper Access Control Vulnerability (CVE-2020-13677)

PostgreSQL Improper Input Validation Vulnerability (CVE-2013-0255)

Joomla! Core 3.x.x Cross-Site Scripting (3.0.0 - 3.9.15)

Severity

Medium

Classification

CVE-2020-8660 CWE-345 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities