Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Envoy Proxy Insufficient Verification of Data Authenticity Vulnerability - CVE-2020-8660 - Vulnerability Database
Envoy Proxy

Envoy Proxy Insufficient Verification of Data Authenticity Vulnerability - CVE-2020-8660

Medium
Reference: CVE-2020-8660
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-8660
Title: Envoy Proxy Insufficient Verification of Data Authenticity Vulnerability
Overview:

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI ALPN) were not inspected those connections might have been matched to a wrong filter chain possibly bypassing some security restrictions in the process.