Description
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.
Remediation
References
Related Vulnerabilities
Oracle Application Server CVE-2008-3986 Vulnerability (CVE-2008-3986)
WordPress Plugin FCChat Widget 'path' Parameter Cross-Site Scripting (2.1.7)
phpMyAdmin Improper Input Validation Vulnerability (CVE-2016-9860)
WordPress Plugin Yet Another Photoblog Unspecified Vulnerability (1.10.6)
Chamilo Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2023-4224)