-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in NeuVector's default configuration, which did not enforce TLS verification for OpenID Connect, making it susceptible to Man-in-the-Middle (MITM) attacks. The analysis of the provided patch 955904b5762f296d209bf395a5fcc7a40a53c424 reveals that the function createDefaultServiceMeshMonitor in controller/kv/create.go is responsible for setting the initial system configuration. The patch modifies this function to set the EnableTLSVerification flag to true by default for new deployments. This change ensures that TLS verification is enforced for connections to authentication servers (including OIDC), registries, and webhooks, thereby closing the security gap. Although this function does not directly handle malicious input, it is the root cause of the vulnerability as it established the insecure default setting.
createDefaultServiceMeshMonitorcontroller/kv/create.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/neuvector/neuvector | go | >= 5.3.0, < 5.4.8 | 5.4.8 |