{"containers": {"cna": {"affected": [{"product": "contour", "vendor": "projectcontour", "versions": [{"status": "affected", "version": "< 1.17.1"}]}], "descriptions": [{"lang": "en", "value": "Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-07-23T21:50:10", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/projectcontour/contour/releases/tag/v1.17.1"}], "source": {"advisory": "GHSA-5ph6-qq5x-7jwc", "discovery": "UNKNOWN"}, "title": "Authorization bypass in Contour", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-32783", "STATE": "PUBLIC", "TITLE": "Authorization bypass in Contour"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "contour", "version": {"version_data": [{"version_value": "< 1.17.1"}]}}]}, "vendor_name": "projectcontour"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc", "refsource": "CONFIRM", "url": "https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc"}, {"name": "https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e", "refsource": "MISC", "url": "https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e"}, {"name": "https://github.com/projectcontour/contour/releases/tag/v1.17.1", "refsource": "MISC", "url": "https://github.com/projectcontour/contour/releases/tag/v1.17.1"}]}, "source": {"advisory": "GHSA-5ph6-qq5x-7jwc", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:33:55.624Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/projectcontour/contour/releases/tag/v1.17.1"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-32783", "datePublished": "2021-07-23T21:50:10", "dateReserved": "2021-05-12T00:00:00", "dateUpdated": "2024-08-03T23:33:55.624Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "C1D1AE1D-573C-4C57-8117-914E6FB9C7AF", "versionEndExcluding": "1.17.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy remotely (a denial of service), or to expose the existence of any Secret that Envoy is using for its configuration, including most notably TLS Keypairs. However, it *cannot* be used to get the *content* of those secrets. Since this attack allows access to the administration interface, a variety of administration options are available, such as shutting down the Envoy or draining traffic. In general, the Envoy admin interface cannot easily be used for making changes to the cluster, in-flight requests, or backend services, but it could be used to shut down or drain Envoy, change traffic routing, or to retrieve secret metadata, as mentioned above. The issue will be addressed in Contour v1.18.0 and a cherry-picked patch release, v1.17.1, has been released to cover users who cannot upgrade at this time. For more details refer to the linked GitHub Security Advisory."}, {"lang": "es", "value": "Contour es un controlador de entrada de Kubernetes usando el proxy Envoy. En Contour versiones anteriores a 1.17.1 se puede usar un servicio de tipo ExternalName especialmente dise\u00f1ado para acceder a la interfaz de administraci\u00f3n de Envoy, que Contour normalmente impide el acceso fuera del contenedor Envoy. Esto puede ser usado para cerrar Envoy de forma remota (una denegaci\u00f3n de servicio), o para exponer la existencia de cualquier secreto que Envoy est\u00e9 usando para su configuraci\u00f3n, incluyendo especialmente los pares de claves TLS. Sin embargo, *no* puede ser usado para obtener el *contenido* de esos secretos. Dado que este ataque permite el acceso a la interfaz de administraci\u00f3n, se presentan diversas opciones de administraci\u00f3n, como apagar el Envoy o drenar el tr\u00e1fico. En general, la interfaz de administraci\u00f3n de Envoy no puede ser usada f\u00e1cilmente para realizar cambios en el cluster, las peticiones en vuelo o los servicios backend, pero podr\u00eda ser usado para apagar o drenar Envoy, cambiar el enrutamiento del tr\u00e1fico o recuperar metadatos secretos, como se ha mencionado anteriormente. El problema se abordar\u00e1 en Contour versi\u00f3n v1.18.0 y ha sido lanzado una versi\u00f3n de parche, versi\u00f3n v1.17.1, para cubrir a usuarios que no pueden actualizar en este momento. Para m\u00e1s detalles, consulte el aviso de seguridad de GitHub"}], "id": "CVE-2021-32783", "lastModified": "2021-08-05T16:56:23.153", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2021-07-23T22:15:08.480", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/projectcontour/contour/commit/b53a5c4fd927f4ea2c6cf02f1359d8e28bef852e"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/projectcontour/contour/releases/tag/v1.17.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/projectcontour/contour/security/advisories/GHSA-5ph6-qq5x-7jwc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-610"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-441"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}