CVE-2020-8660 : What You Need to Know

CNCF Envoy through 1.13.0 is affected by a TLS inspector bypass vulnerability that could allow a client using only TLS 1.3 to bypass security restrictions by not inspecting TLS extensions (SNI, ALPN).

Understanding CVE-2020-8660

This CVE involves a vulnerability in CNCF Envoy that could potentially lead to security bypass scenarios.

What is CVE-2020-8660?

CNCF Envoy through version 1.13.0 is susceptible to a TLS inspector bypass. This vulnerability allows a client utilizing only TLS 1.3 to evade TLS inspection, potentially leading to incorrect filter chain matching and security restriction bypass.

The Impact of CVE-2020-8660

The TLS inspector bypass in CNCF Envoy could result in connections being misrouted, potentially circumventing security measures and exposing systems to unauthorized access or data breaches.

Technical Details of CVE-2020-8660

This section delves into the technical aspects of the vulnerability.

Vulnerability Description

The TLS inspector in CNCF Envoy up to version 1.13.0 could be bypassed by clients using only TLS 1.3, as it did not inspect TLS extensions like SNI and ALPN. This oversight could lead to incorrect filter chain matching and security restriction bypass.

Affected Systems and Versions

Product: CNCF Envoy
Vendor: Not applicable
Versions affected: Up to 1.13.0

Exploitation Mechanism

The vulnerability allows clients using TLS 1.3 to evade TLS inspection, potentially leading to connections being matched to incorrect filter chains and bypassing security restrictions.

Mitigation and Prevention

Protecting systems from CVE-2020-8660 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update CNCF Envoy to a version beyond 1.13.0 that addresses the TLS inspector bypass vulnerability.
Monitor network traffic for any suspicious activities that might indicate exploitation of the vulnerability.

Long-Term Security Practices

Implement a robust TLS inspection mechanism that includes thorough examination of TLS extensions.
Regularly update and patch CNCF Envoy to mitigate potential security risks.

Patching and Updates

Apply patches provided by CNCF Envoy to fix the TLS inspector bypass vulnerability.