CVE-2020-8595
published 2020-02-12CVE-2020-8595: Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path…
PriorityP349high7.3CVSS 3.1
AVNACLPRNUINSUCLILAL
EPSS
2.61%
83.6th percentile
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| istio | istio | 1.3 – 1.3.7 | — |
| istio | istio | 1.4.0 – 1.4.3 | — |
| redhat | openshift_service_mesh | — | — |
CVSS provenance
nvdv3.17.3HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
istio: unauthorised access to JWT protected HTTP path
vendor_redhat·2020-02-11·CVSS 7.3
CVE-2020-8595 [HIGH] CWE-285 istio: unauthorised access to JWT protected HTTP path
istio: unauthorised access to JWT protected HTTP path
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
An unauthorized access vulnerability was found in Istio in the servicemesh-proxy. An attacker can use this flaw to specify an HTTP path and gain unauthorized access, even if the path is configured to only be accessed with a valid JSON Web Token (JWT).
Mitigation: Depending on the paths used in the exact match clause, it is possible
GHSA
GHSA-6mcc-fxc5-58cv: Istio 1
ghsa_unreviewed·2022-05-24
CVE-2020-8595 [HIGH] GHSA-6mcc-fxc5-58cv: Istio 1
Istio 1.3 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-8595 webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
bugzilla·2020-09-08·CVSS 8.8
CVE-2019-8595 [HIGH] CVE-2019-8595 webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
CVE-2019-8595 webkitgtk: Multiple memory corruption issues leading to arbitrary code execution
WebKitGTK Security Advisory WSA-2019-0003 describes the following issue:
CVE-2019-8595
Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
Versions affected: WebKitGTK and WPE WebKit before 2.24.2.
Discussion:
External References:
https://webkitgtk.org/security/WSA-2019-0003.html
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:4035 https://access.redhat.com/errata/RHSA-2020:4035
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/c
Bugzilla
CVE-2020-8595 istio: unauthorised access to JWT protected HTTP path
bugzilla·2020-02-04·CVSS 7.3
CVE-2020-8595 [HIGH] CVE-2020-8595 istio: unauthorised access to JWT protected HTTP path
CVE-2020-8595 istio: unauthorised access to JWT protected HTTP path
A flaw was found in Istio in all versions released after 1.3 (included). The flaw is in Istio's Authentication Policy exact path matching logic and can allow unauthorized access to a HTTP path, even if the path is configured to be only accessed with a valid JWT token.
Discussion:
Mitigation:
Depending on the paths used in the exact match clause, it is possible to update the path to a regex.
As provided by the Istio Product Committee, the following mitigation can be employed.
The original policy specifying a JWT protected path is as follows:
---
apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
name: "jwt-example"
namespace: istio-system
spec:
targets:
- name: istio-ingressgateway
origins:
- jwt:
https://access.redhat.com/errata/RHSA-2020:0477https://access.redhat.com/security/cve/cve-2020-8595https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8595https://github.com/istio/istio/commits/masterhttps://istio.io/news/security/https://istio.io/news/security/istio-security-2020-001/https://access.redhat.com/errata/RHSA-2020:0477https://access.redhat.com/security/cve/cve-2020-8595https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8595https://github.com/istio/istio/commits/masterhttps://istio.io/news/security/https://istio.io/news/security/istio-security-2020-001/
2020-02-12
Published