CVE-2020-16844

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
References
Link Resource
https://github.com/istio/istio/releases Vendor Advisory
https://istio.io/latest/news/security/istio-security-2020-009/ Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*
cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-10-01 17:15

Updated : 2024-02-04 21:23


NVD link : CVE-2020-16844

Mitre link : CVE-2020-16844

CVE.ORG link : CVE-2020-16844


JSON object : View

Products Affected

istio

  • istio