ISTIO-SECURITY-2020-007

CVE-2020-8663 is addressed in Envoy by adding a configurable limit on downstream connections. The limit must be configured to mitigate this vulnerability. Perform the following steps to configure limits at the ingress gateway.

{{< security_bulletin >}}

Envoy, and subsequently Istio, are vulnerable to four newly discovered vulnerabilities:

• CVE-2020-12603: By sending a specially crafted packet, an attacker could cause Envoy to consume excessive amounts of memory when proxying HTTP/2 requests or responses.

  • CVSS Score: 7.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• CVE-2020-12605: An attacker could cause Envoy to consume excessive amounts of memory when processing specially crafted HTTP/1.1 packets.

  • CVSS Score: 7.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• CVE-2020-8663: An attacker could cause Envoy to exhaust file descriptors when accepting too many connections.

  • CVSS Score: 7.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• CVE-2020-12604: An attacker could cause increased memory usage when processing specially crafted packets.

  • CVSS Score: 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Mitigation

• For Istio 1.5.x deployments: update to Istio 1.5.7 or later.
• For Istio 1.6.x deployments: update to Istio 1.6.4 or later.

{{< warning >}} You must take the following additional steps to mitigate CVE-2020-8663. {{< /warning >}}

{{< boilerplate cve-2020-007-configmap >}}

{{< boilerplate "security-vulnerability" >}}