Sign-up

ID

VAR-202107-1478


CVE

CVE-2021-36371


TITLE

Emissary-Ingress trust management issue vulnerability

Trust: 1.2

sources: CNVD: CNVD-2021-59140 // CNNVD: CNNVD-202107-566

DESCRIPTION

Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.). Emissary-Ingress ( Old Ambassador API Gateway) Contains a certificate validation vulnerability.Information may be tampered with. Emissary-Ingress is an open source Kubernetes native API gateway for microservices built by Envoy proxy

Trust: 2.25

sources: NVD: CVE-2021-36371 // JVNDB: JVNDB-2021-009379 // CNVD: CNVD-2021-59140 // VULMON: CVE-2021-36371

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-59140

AFFECTED PRODUCTS

vendor:getambassadormodel:emissary-ingressscope:lteversion:1.13.9

Trust: 1.0

vendor:ambassadormodel:emissary ingressscope:lteversion:1.13.9 until

Trust: 0.8

vendor:ambassadormodel:emissary ingressscope:eqversion: -

Trust: 0.8

vendor:emissary ingressmodel:emissary-ingressscope:ltversion:1.13.9

Trust: 0.6

sources: CNVD: CNVD-2021-59140 // JVNDB: JVNDB-2021-009379 // NVD: CVE-2021-36371

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-36371
value: LOW

Trust: 1.0

NVD: CVE-2021-36371
value: LOW

Trust: 0.8

CNVD: CNVD-2021-59140
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202107-566
value: LOW

Trust: 0.6

VULMON: CVE-2021-36371
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-36371
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2021-59140
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-36371
baseSeverity: LOW
baseScore: 3.7
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2021-36371
baseSeverity: LOW
baseScore: 3.7
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-59140 // VULMON: CVE-2021-36371 // JVNDB: JVNDB-2021-009379 // CNNVD: CNNVD-202107-566 // NVD: CVE-2021-36371

PROBLEMTYPE DATA

problemtype:CWE-295

Trust: 1.0

problemtype:Bad certificate verification (CWE-295) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-009379 // NVD: CVE-2021-36371

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202107-566

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202107-566

PATCH

title:Emissary Ingress 2.0.0-eaurl:https://github.com/emissary-ingress/emissary/releases/tag/v2.0.0-ea

Trust: 0.8

title:Patch for Emissary-Ingress trust management issue vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/284311

Trust: 0.6

sources: CNVD: CNVD-2021-59140 // JVNDB: JVNDB-2021-009379

EXTERNAL IDS

db:NVDid:CVE-2021-36371

Trust: 3.9

db:JVNDBid:JVNDB-2021-009379

Trust: 0.8

db:CNVDid:CNVD-2021-59140

Trust: 0.6

db:CNNVDid:CNNVD-202107-566

Trust: 0.6

db:VULMONid:CVE-2021-36371

Trust: 0.1

sources: CNVD: CNVD-2021-59140 // VULMON: CVE-2021-36371 // JVNDB: JVNDB-2021-009379 // CNNVD: CNNVD-202107-566 // NVD: CVE-2021-36371

REFERENCES

url:https://github.com/emissary-ingress/emissary/issues/3340

Trust: 1.7

url:https://github.com/emissary-ingress/emissary/releases/tag/v2.0.0-ea

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-36371

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/295.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-59140 // VULMON: CVE-2021-36371 // JVNDB: JVNDB-2021-009379 // CNNVD: CNNVD-202107-566 // NVD: CVE-2021-36371

SOURCES

db:CNVDid:CNVD-2021-59140
db:VULMONid:CVE-2021-36371
db:JVNDBid:JVNDB-2021-009379
db:CNNVDid:CNNVD-202107-566
db:NVDid:CVE-2021-36371

LAST UPDATE DATE

2024-08-14T15:33:06.413000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-59140date:2021-08-06T00:00:00
db:VULMONid:CVE-2021-36371date:2021-07-14T00:00:00
db:JVNDBid:JVNDB-2021-009379date:2022-04-22T05:57:00
db:CNNVDid:CNNVD-202107-566date:2021-07-15T00:00:00
db:NVDid:CVE-2021-36371date:2021-07-14T14:57:33.607

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-59140date:2021-08-06T00:00:00
db:VULMONid:CVE-2021-36371date:2021-07-09T00:00:00
db:JVNDBid:JVNDB-2021-009379date:2022-04-22T00:00:00
db:CNNVDid:CNNVD-202107-566date:2021-07-09T00:00:00
db:NVDid:CVE-2021-36371date:2021-07-09T21:15:08.583