CVE-2020-1764

CVE Details

Release Date:	2020-03-26
Impact:	None	What is this?

Description

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.

See more information about CVE-2020-1764 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	8.6
Vector String:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	Low
Integrity Impact:	Low
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (istio)	ELSA-2020-5765	2020-07-22
Oracle Linux version 7 (kata)	ELSA-2020-5765	2020-07-22
Oracle Linux version 7 (kata-image)	ELSA-2020-5765	2020-07-22
Oracle Linux version 7 (kata-runtime)	ELSA-2020-5765	2020-07-22
Oracle Linux version 7 (kernel-uek-container)	ELSA-2020-5765	2020-07-22
Oracle Linux version 7 (kubernetes)	ELSA-2020-5765	2020-07-22
Oracle Linux version 7 (olcne)	ELSA-2020-5765	2020-07-22