An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2020-02-14T18:45:19

Updated: 2024-08-04T10:12:10.957Z

Reserved: 2020-02-10T00:00:00

Link: CVE-2020-8843

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-02-14T19:15:10.683

Modified: 2024-11-21T05:39:33.013

Link: CVE-2020-8843

cve-icon Redhat

No data.