ISTIO-SECURITY-2020-004

Security Bulletin

Disclosure Details
CVE(s) CVE-2020-1764
CVSS Impact Score 8.7 AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Releases 1.4 to 1.4.6
1.5

Istio 1.4 to 1.4.6 and Istio 1.5 contain the following vulnerability:

In addition, another CVE is fixed in this release, described by this Kiali security bulletin.

Detection

Your installation is vulnerable in the following configuration:

  • The Kiali version is 1.15 or earlier.
  • The Kiali login token and signing key is unset.

To check your Kiali version, run this command:

$ kubectl get pods -n istio-system -l app=kiali -o yaml | grep image:

To determine if your login token is unset, run this command and check for blank output:

$ kubectl get deploy kiali -n istio-system -o yaml | grep LOGIN_TOKEN_SIGNING_KEY

To determine if your signing key is unset, run this command and check for blank output:

$ kubectl get cm kiali -n istio-system -o yaml | grep signing_key

Mitigation

  • For Istio 1.4.x deployments: update to Istio 1.4.7 or later.
  • For Istio 1.5.x deployments: update to Istio 1.5.1 or later.
  • Workaround: You can manually update the signing key to a random token using the following command:

    $ kubectl get cm kiali -n istio-system -o yaml | sed "s/server:/login_token:\\\n \
    signing_key: $(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 20 | head -n 1)\\\nserver:/" \
    | kubectl apply -f - ; kubectl delete pod -l app=kiali -n istio-system
    
Was this information useful?
Do you have any suggestions for improvement?

Thanks for your feedback!