Description
A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | kiali | all Kiali versions prior to 1.15.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | istio +10 | 1.4.10-1.0.1.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kata | 1.7.3-1.0.7.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kata-image | 1.7.3-1.0.5.1.ol7_202007011859 | ELSA-2020-5765 |
| Oracle Linux 7 | kata-runtime | 1.7.3-1.0.5.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kernel-uek-container | 4.14.35-1902.303.5.3.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | kubeadm +2 | 1.17.9-1.0.1.el7 | ELSA-2020-5765 |
| Oracle Linux 7 | olcnectl +6 | 1.1.2-6.el7 | ELSA-2020-5765 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
jpts/cve-2020-1764-poc ★ 1 · Jul 6, 2020
Auth Bypass PoC for Kiali
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/kiali/kiali | < 1.15.1 | 1.15.1 | GHSA-64rh-r86q-75ff |
Advisories 1
- ELSA-2020-5765 Important: Unbreakable Enterprise kernel-container kata-image kata-runtime kata kubernetes kubernetes istio olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 22, 2020