Описание
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
A flaw was found in Envoy. This vulnerability allows mTLS (mutual Transport Layer Security) certificate validation bypass via a certificate containing an embedded null byte (\0) inside an OTHERNAME SAN (Subject Alternative Name) value.
Отчет
This vulnerability is rated Moderate for Red Hat products. Envoy's mTLS certificate matcher, when configured with match_typed_subject_alt_names, may incorrectly validate certificates containing an embedded null byte in the OTHERNAME SAN field. This could allow an attacker to bypass mTLS authentication if they can present a specially crafted certificate.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2 | openshift-service-mesh/grafana-rhel8 | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-cni-rhel8 | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-must-gather-rhel9 | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-operator-bundle | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-rhel8-operator | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/pilot-rhel8 | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/proxyv2-rhel9 | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/ratelimit-rhel8 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-cni-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5 Medium
CVSS3
Связанные уязвимости
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subject_alt_names may incorrectly treat certificates containing an embedded null byte (\0) inside an OTHERNAME SAN value as valid matches.
Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.3 ...
Envoy's TLS certificate matcher for `match_typed_subject_alt_names` may incorrectly treat certificates containing an embedded null byte
EPSS
5 Medium
CVSS3