CVE-2020-16844 Authorization bypass in Istio
Attackers can bypass Istio authorization policies by exploiting wildcard suffix handling in DENY rules, allowing unauthorized access to protected services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-16844?
CVE-2020-16844 is a medium-severity authentication bypass vulnerability in n/a, published on 1 Oct 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.
Which versions are affected by CVE-2020-16844?
4 open source packages ship an affected version, including istio.io/istio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
istio.io/istio Go | From 1.5.0 | 1.5.9 |
istio.io/istio Go | From 1.5.0 | 1.5.9 |
istio.io/istio Go | From 1.6.0 | 1.6.8 |
istio.io/istio Go | From 1.6.0 | 1.6.8 |
Linux distribution packages (9)
servicemesh Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-citadel Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-galley Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-istioctl Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-mixc Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-mixs Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-pilot-agent Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-pilot-discovery Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
servicemesh-sidecar-injector Red Hat:service_mesh:1.1::el8 | All versions | 0:1.1.7-1.el8 |
Products include Istio Istio.
How do I fix CVE-2020-16844?
Upgrade istio.io/istio to a fixed version for your release line: 1.5.9 or 1.6.8.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-16844 being exploited?
There is no known exploitation of CVE-2020-16844 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-31921 Missing authorization in n/a
- CVE-2021-34824 Information disclosure in n/a
- CVE-2026-31837 Istio JWKS resolver to prevent private key material from being exposed when JWKS fetch fails.
- CVE-2021-39155 Authorization Policy Bypass Due to Case Insensitive Host Comparison
- CVE-2021-39156 Fragments in Path May Lead to Authorization Policy Bypass
Sources
Also known as GHSA-82mm-ffjr-h86c, RHSA-2020:3425.