Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2020-10739

Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 68.9%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
Products affected by CVE-2020-10739
  • Istio » Istio » Version: 1.4.0
    cpe:2.3:a:istio:istio:1.4.0
  • Istio » Istio » Version: 1.4.1
    cpe:2.3:a:istio:istio:1.4.1
  • Istio » Istio » Version: 1.4.2
    cpe:2.3:a:istio:istio:1.4.2
  • Istio » Istio » Version: 1.4.3
    cpe:2.3:a:istio:istio:1.4.3
  • Istio » Istio » Version: 1.4.4
    cpe:2.3:a:istio:istio:1.4.4
  • Istio » Istio » Version: 1.4.5
    cpe:2.3:a:istio:istio:1.4.5
  • Istio » Istio » Version: 1.4.6
    cpe:2.3:a:istio:istio:1.4.6
  • Istio » Istio » Version: 1.4.7
    cpe:2.3:a:istio:istio:1.4.7
  • Istio » Istio » Version: 1.4.8
    cpe:2.3:a:istio:istio:1.4.8
  • Istio » Istio » Version: 1.5.0
    cpe:2.3:a:istio:istio:1.5.0
  • Istio » Istio » Version: 1.5.1
    cpe:2.3:a:istio:istio:1.5.1
  • Istio » Istio » Version: 1.5.2
    cpe:2.3:a:istio:istio:1.5.2
  • Istio » Istio » Version: 1.5.3
    cpe:2.3:a:istio:istio:1.5.3


Products
Pricing
Contact Us

Shodan ® - All rights reserved