CVE-2020-15104

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15104
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15104.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-15104
Aliases
Downstream
Related
  • GHSA-w5f5-6qhq-hhrg
Published
2020-07-14T22:15:10.937Z
Modified
2026-02-11T12:43:11.971608Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verifysubjectaltname in any Envoy version, or if they use matchsubjectaltnames in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.

References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b2ffdd89c21163ddf9907af572927214578321d3
Introduced
bb7ceff4c3c5bd4555dff28b6e56d27f2f8be0a7
Fixed
74c221751138e5add71e0738d40092434b76a7cf
Introduced
de12027c9c2de685d85cf1bf0db58280ac06d0a3
Fixed
923c4111bb48405ac96ef050c4f59ebbad3d7761

Affected versions

v1.*
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.14.0
v1.14.1
v1.14.2
v1.14.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15104.json"
vanir_signatures 
[
    {
        "digest": {
            "line_hashes": [
                "233543062476617455522480951633830020250",
                "97108442375790762321947506946146541766",
                "236078779863198350661865444030006578300",
                "217084393302201368235197092372183325808",
                "253512937360547730484625776052545965569",
                "315161121815167039058386564384424613564",
                "64277962717543938870529550573365524761",
                "72875440554671668837253923501258011547",
                "84104220733247219013251384886684106260",
                "162857772582046208225038114579385705313",
                "203900709926243891977859016555955575638"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-1b96f9dc",
        "source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "337794905070803939227931734975121996173",
                "202744723883745882325722813226801796850",
                "307403683100710314007766550973930935129",
                "71576635782893112794958766841295732193"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "source/common/runtime/runtime_features.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-2e18951b",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "28779119861937653086437382208329983326",
            "length": 383.0
        },
        "signature_version": "v1",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc",
            "function": "ContextImpl::dnsNameMatch"
        },
        "signature_type": "Function",
        "id": "CVE-2020-15104-39205cc1",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "28779119861937653086437382208329983326",
            "length": 383.0
        },
        "signature_version": "v1",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc",
            "function": "ContextImpl::dnsNameMatch"
        },
        "signature_type": "Function",
        "id": "CVE-2020-15104-393add04",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "312482283805291095438923251672072131439",
                "220996073553402672095052871159566003960",
                "225605447920888299205560649969478071419",
                "216074756123785505219057397401881189160",
                "225183954402081914494728565549147429990",
                "259023672528975640961000503553777442026",
                "161652464319304482070638074318483824358",
                "186543543005256202179911235079325749535",
                "174062542631163710893467166719856178633"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-45f9c4c3",
        "source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "158243945918798290641310539615865985981",
            "length": 377.0
        },
        "signature_version": "v1",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc",
            "function": "ContextImpl::dnsNameMatch"
        },
        "signature_type": "Function",
        "id": "CVE-2020-15104-4886614a",
        "source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "30416483983452382113593354048911689175",
                "7006177416420883513667164665955777838",
                "54237066091106826134043533378769239784",
                "296376495841226771031904197612387717830"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "source/common/runtime/runtime_features.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-bbf83fcd",
        "source": "https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "312482283805291095438923251672072131439",
                "220996073553402672095052871159566003960",
                "40086084292754689512564420965752459566",
                "94823427644843023793365845609281227913",
                "141395624926811225767987841494254951177",
                "176512010242898287731274919855203773803",
                "227516053637018354786110661305768681255",
                "174062542631163710893467166719856178633"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-be1a2ad7",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "312482283805291095438923251672072131439",
                "220996073553402672095052871159566003960",
                "40086084292754689512564420965752459566",
                "94823427644843023793365845609281227913",
                "141395624926811225767987841494254951177",
                "176512010242898287731274919855203773803",
                "227516053637018354786110661305768681255",
                "174062542631163710893467166719856178633"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "source/extensions/transport_sockets/tls/context_impl.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-bf9f394d",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "233543062476617455522480951633830020250",
                "97108442375790762321947506946146541766",
                "236078779863198350661865444030006578300",
                "217084393302201368235197092372183325808",
                "253512937360547730484625776052545965569",
                "315161121815167039058386564384424613564",
                "64277962717543938870529550573365524761",
                "72875440554671668837253923501258011547",
                "81300124250093106394977748984017597331",
                "101683283838141849943852093785343137139",
                "131119519122332572623478841771969132778",
                "308919626256172706172868507353292004170",
                "123542765986267060558112767084589470053",
                "10614619178787704648544071763761786587"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-c0db564d",
        "source": "https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "233543062476617455522480951633830020250",
                "97108442375790762321947506946146541766",
                "236078779863198350661865444030006578300",
                "217084393302201368235197092372183325808",
                "253512937360547730484625776052545965569",
                "315161121815167039058386564384424613564",
                "64277962717543938870529550573365524761",
                "72875440554671668837253923501258011547",
                "81300124250093106394977748984017597331",
                "101683283838141849943852093785343137139",
                "131119519122332572623478841771969132778",
                "308919626256172706172868507353292004170",
                "123542765986267060558112767084589470053",
                "10614619178787704648544071763761786587"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "test/extensions/transport_sockets/tls/context_impl_test.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-c14f4174",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "deprecated": false
    },
    {
        "digest": {
            "line_hashes": [
                "125811849769319573303093856788139619288",
                "224857307662273072018732854724032506811",
                "292180642878870327006629255906516181527",
                "301766763199064114172539348285366539316"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "target": {
            "file": "source/common/runtime/runtime_features.cc"
        },
        "signature_type": "Line",
        "id": "CVE-2020-15104-ed2df316",
        "source": "https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761",
        "deprecated": false
    }
]