CVE-2020-8660: 
NixOS vulnerability analysis and mitigation

CNCF Envoy through 1.13.0 contains a TLS inspector bypass vulnerability. The vulnerability allows TLS inspector to be bypassed by a client using only TLS 1.3, as TLS extensions (SNI, ALPN) were not being inspected. This could result in connections being matched to incorrect filter chains, potentially bypassing security restrictions (Envoy Advisory, NVD).

The vulnerability has been assigned CVE-2020-8660 with a CVSS v3.1 Base Score of 5.3 (MEDIUM). The vulnerability stems from insufficient verification of data authenticity (CWE-345) in the TLS inspection process. When a client uses TLS 1.3, the TLS inspector fails to properly inspect TLS extensions such as SNI and ALPN, leading to potential security bypass (NVD).

The vulnerability could result in connections being matched to incorrect filter chains, potentially bypassing security restrictions. This could lead to unauthorized access or bypass of security controls intended to be enforced by the TLS inspector (Envoy Advisory).

The vulnerability has been fixed in Envoy versions 1.13.1 and 1.12.3. Users are advised to upgrade to these or later versions to address the security issue (Envoy Advisory, Envoy Version History).