In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle_linux | — | Upgrade istio-pilot-agentUpgrade olcne-utilsUpgrade kernel-uek-containerUpgrade olcne-prometheus-chartUpgrade istio-pilot-discoveryUpgrade istio-istioctlUpgrade olcne-istio-chartUpgrade kata-imageUpgrade kubeadmUpgrade istio-node-agentUpgrade kata-runtimeUpgrade olcne-api-serverUpgrade istio-mixcUpgrade olcnectlUpgrade istioUpgrade kubernetesUpgrade istio-mixsUpgrade olcne-nginxUpgrade istio-proxy-initUpgrade olcneUpgrade istio-citadelUpgrade kubectlUpgrade kataUpgrade istio-galleyUpgrade olcne-agentUpgrade istio-sidecar-injectorUpgrade kubelet | Jul 23, 2020 | Jul 14, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 14, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub