{"id":"CVE-2020-16844","published":"2020-10-01T16:32:38Z","modified":"2024-08-04T13:45:34Z","title":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with…","vendor":null,"product":null,"tier":"tail","description":{"text":"In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY actions using wildcard suffixes (e.g. *-some-suffix) for source principals or namespace fields, callers will never be denied access, bypassing the intended policy.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01095,"percentile":0.65455,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/istio/istio/releases","tags":["x_refsource_MISC"]},{"url":"https://istio.io/latest/news/security/istio-security-2020-009/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":13.1,"factors":[{"name":"EPSS percentile","points":13.09}]},"affected":[{"ecosystem":"Go","package":"istio.io/istio","vulnerableRanges":[">=1.5.0, <1.5.9",">=1.6.0, <1.6.8"],"patched":["1.5.9","1.6.8"],"from":["GHSA-82mm-ffjr-h86c"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0899","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-istio-cve-2020-16844","children":[{"from":"CVE-2020-16844","to":"CVE-2021-39155","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Go:istio.io/istio","fromFixed":"1.6.8","toFixed":"1.9.8","daysApart":327},{"kind":"same-code","provenance":"machine","files":["pilot/pkg/security/authz/model/generator.go"],"commits":["https://github.com/istio/istio/commit/4c73414556b83f0e75c1b3a0a89a23103a71573c","https://github.com/istio/istio/commit/72d2e135374f421b656d6f1a21f474db46134ace","https://github.com/istio/istio/commit/084b417a486dbe9b9024d4812877016a484572b1","https://github.com/istio/istio/commit/76ed51413ddd2a7fa253a368ab20a9cec5fb1cbe"],"basis":"shared function","functions":["permission"]}]}],"packageHistory":[{"cve":"CVE-2019-12243","published":"2019-06-05","fixed":"1.1.7","kev":false},{"cve":"CVE-2019-14993","published":"2019-08-13","fixed":"1.2.4","kev":false},{"cve":"CVE-2019-18817","published":"2019-11-12","fixed":"1.3.5","kev":false},{"cve":"CVE-2020-16844","published":"2020-10-01","fixed":"1.6.8","kev":false},{"cve":"CVE-2021-39155","published":"2021-08-24","fixed":"1.11.1","kev":false},{"cve":"CVE-2021-39156","published":"2021-08-24","fixed":"1.11.1","kev":false,"link":{"from":"CVE-2020-16844","to":"CVE-2021-39156","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:istio.io/istio","fromFixed":"1.6.8","toFixed":"1.9.8","daysApart":327}]}},{"cve":"CVE-2022-23635","published":"2022-02-22","fixed":"1.13.1","kev":false}],"package":"Go:istio.io/istio"}}