CVE-2020-15104

In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.

• CWE-346
• CWE-346

• https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrgThird Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-w5f5-6qhq-hhrgThird Party Advisory

Published

Jul 14, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15099In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.…8.1
• CVE-2020-1510An information disclosure vulnerability exists when the win3…5.5
• CVE-2020-15100In freewvs before 0.1.1, a user could create a large file th…3.3
• CVE-2020-15101In freewvs before 0.1.1, a directory structure of more than …3.3
• CVE-2020-15102In PrestaShop Dashboard Productions before version 2.1.0, th…6.5
• CVE-2020-15103In FreeRDP less than or equal to 2.1.2, an integer overflow …3.5
• CVE-2020-15105Django Two-Factor Authentication before 1.12, stores the use…5.4
• CVE-2020-15106In etcd before versions 3.3.23 and 3.4.10, a large slice cau…6.5
• CVE-2020-15107In openenclave before 0.10.0, enclaves that use x87 FPU oper…5.3
• CVE-2020-15108In glpi before 9.5.1, there is a SQL injection for all usage…7.1
• CVE-2020-15109In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there i…5.3
• CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8