GHSA-64rh-r86q-75ff
Suggest an improvement- Source
- https://github.com/advisories/GHSA-64rh-r86q-75ff
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-64rh-r86q-75ff/GHSA-64rh-r86q-75ff.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-64rh-r86q-75ff
- Aliases
- Published
- 2021-05-18T18:28:59Z
- Modified
- 2024-08-21T15:27:41.389055Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
- Summary
- Hard coded cryptographic key in Kiali
- Details
-
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
- Database specific
{ "nvd_published_at": null, "github_reviewed": true, "github_reviewed_at": "2021-05-06T21:51:32Z", "severity": "HIGH", "cwe_ids": [ "CWE-321", "CWE-798" ] }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-1764
- https://github.com/kiali/kiali/commit/93f5cd0b6698e8fe8772afb8f35816f6c086aef1
- https://github.com/kiali/kiali/commit/ac7bd6c7ddb2e01356e21d360dd1c718a90706ad
- https://github.com/kiali/kiali/commit/ce48af57113c805a25179aaab1a0fac2fb93653f
- https://github.com/kiali/kiali/commit/faed1f5f90efae3df9fd6fb793f00ccc242b3a96
- https://bugzilla.redhat.com/show_bug.cgi?id=1810383
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764
- https://github.com/jpts/cve-2020-1764-poc
- https://kiali.io/news/security-bulletins/kiali-security-001
Affected packages
Go / github.com/kiali/kiali
Package
- Name
- github.com/kiali/kiali
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/kiali/kiali