Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.)
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Emissary-Ingress 信任管理问题漏洞
Vulnerability Description
Emissary-Ingress是开源的一个用于 Envoy 代理构建的微服务的 Kubernetes 原生 API 网关。 Emissary-Ingress 存在安全漏洞，该漏洞源于通过1.13.9版本的Emissary-Ingress定义了多个TLSContext且至少存在一个不需要客户端证书认证的配置。攻击者可利用该漏洞绕过后端上游户端证书要求(即需要mTLS证书)。
CVSS Information
N/A
Vulnerability Type
N/A