{"id":"CVE-2020-15104","details":"In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.","aliases":["BIT-envoy-2020-15104","GHSA-w5f5-6qhq-hhrg"],"modified":"2026-08-07T15:14:16.349894Z","published":"2020-07-14T22:15:10.937Z","references":[{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrg"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"fixed":"b2ffdd89c21163ddf9907af572927214578321d3"},{"introduced":"bb7ceff4c3c5bd4555dff28b6e56d27f2f8be0a7"},{"fixed":"74c221751138e5add71e0738d40092434b76a7cf"},{"introduced":"de12027c9c2de685d85cf1bf0db58280ac06d0a3"},{"fixed":"923c4111bb48405ac96ef050c4f59ebbad3d7761"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.12.6"},{"introduced":"1.13.0"},{"fixed":"1.13.4"},{"introduced":"1.14.0"},{"fixed":"1.14.4"}]}}],"versions":["v1.14.3","v1.13.3","v1.12.5","v1.14.2","v1.13.2","v1.12.4","v1.12.3","v1.13.1","v1.14.1","v1.14.0","v1.12.2","v1.13.0","v1.12.1","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15104.json","vanir_signatures_modified":"2026-08-07T15:14:16Z","vanir_signatures":[{"target":{"file":"test/extensions/transport_sockets/tls/context_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["233543062476617455522480951633830020250","97108442375790762321947506946146541766","236078779863198350661865444030006578300","217084393302201368235197092372183325808","253512937360547730484625776052545965569","315161121815167039058386564384424613564","64277962717543938870529550573365524761","72875440554671668837253923501258011547","84104220733247219013251384886684106260","162857772582046208225038114579385705313","203900709926243891977859016555955575638"],"threshold":0.9},"id":"CVE-2020-15104-1b96f9dc","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3"},{"source":"https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["337794905070803939227931734975121996173","202744723883745882325722813226801796850","307403683100710314007766550973930935129","71576635782893112794958766841295732193"],"threshold":0.9},"id":"CVE-2020-15104-2e18951b","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761","target":{"file":"source/extensions/transport_sockets/tls/context_impl.cc","function":"ContextImpl::dnsNameMatch"},"deprecated":false,"digest":{"function_hash":"28779119861937653086437382208329983326","length":383},"id":"CVE-2020-15104-39205cc1","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2020-15104-393add04","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf","target":{"file":"source/extensions/transport_sockets/tls/context_impl.cc","function":"ContextImpl::dnsNameMatch"},"deprecated":false,"digest":{"function_hash":"28779119861937653086437382208329983326","length":383}},{"id":"CVE-2020-15104-45f9c4c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3","target":{"file":"source/extensions/transport_sockets/tls/context_impl.cc"},"deprecated":false,"digest":{"line_hashes":["312482283805291095438923251672072131439","220996073553402672095052871159566003960","225605447920888299205560649969478071419","216074756123785505219057397401881189160","225183954402081914494728565549147429990","259023672528975640961000503553777442026","161652464319304482070638074318483824358","186543543005256202179911235079325749535","174062542631163710893467166719856178633"],"threshold":0.9}},{"target":{"file":"source/extensions/transport_sockets/tls/context_impl.cc","function":"ContextImpl::dnsNameMatch"},"deprecated":false,"digest":{"function_hash":"158243945918798290641310539615865985981","length":377},"id":"CVE-2020-15104-4886614a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3"},{"source":"https://github.com/envoyproxy/envoy/commit/b2ffdd89c21163ddf9907af572927214578321d3","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["30416483983452382113593354048911689175","7006177416420883513667164665955777838","54237066091106826134043533378769239784","296376495841226771031904197612387717830"],"threshold":0.9},"id":"CVE-2020-15104-bbf83fcd","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["312482283805291095438923251672072131439","220996073553402672095052871159566003960","40086084292754689512564420965752459566","94823427644843023793365845609281227913","141395624926811225767987841494254951177","176512010242898287731274919855203773803","227516053637018354786110661305768681255","174062542631163710893467166719856178633"],"threshold":0.9},"id":"CVE-2020-15104-be1a2ad7","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf","target":{"file":"source/extensions/transport_sockets/tls/context_impl.cc"}},{"target":{"file":"source/extensions/transport_sockets/tls/context_impl.cc"},"deprecated":false,"digest":{"line_hashes":["312482283805291095438923251672072131439","220996073553402672095052871159566003960","40086084292754689512564420965752459566","94823427644843023793365845609281227913","141395624926811225767987841494254951177","176512010242898287731274919855203773803","227516053637018354786110661305768681255","174062542631163710893467166719856178633"],"threshold":0.9},"id":"CVE-2020-15104-bf9f394d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/74c221751138e5add71e0738d40092434b76a7cf","target":{"file":"test/extensions/transport_sockets/tls/context_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["233543062476617455522480951633830020250","97108442375790762321947506946146541766","236078779863198350661865444030006578300","217084393302201368235197092372183325808","253512937360547730484625776052545965569","315161121815167039058386564384424613564","64277962717543938870529550573365524761","72875440554671668837253923501258011547","81300124250093106394977748984017597331","101683283838141849943852093785343137139","131119519122332572623478841771969132778","308919626256172706172868507353292004170","123542765986267060558112767084589470053","10614619178787704648544071763761786587"],"threshold":0.9},"id":"CVE-2020-15104-c0db564d","signature_type":"Line"},{"target":{"file":"test/extensions/transport_sockets/tls/context_impl_test.cc"},"deprecated":false,"digest":{"line_hashes":["233543062476617455522480951633830020250","97108442375790762321947506946146541766","236078779863198350661865444030006578300","217084393302201368235197092372183325808","253512937360547730484625776052545965569","315161121815167039058386564384424613564","64277962717543938870529550573365524761","72875440554671668837253923501258011547","81300124250093106394977748984017597331","101683283838141849943852093785343137139","131119519122332572623478841771969132778","308919626256172706172868507353292004170","123542765986267060558112767084589470053","10614619178787704648544071763761786587"],"threshold":0.9},"id":"CVE-2020-15104-c14f4174","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/923c4111bb48405ac96ef050c4f59ebbad3d7761","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["125811849769319573303093856788139619288","224857307662273072018732854724032506811","292180642878870327006629255906516181527","301766763199064114172539348285366539316"]},"id":"CVE-2020-15104-ed2df316","signature_type":"Line"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}