CVE-2020-12143

Summary – The certificate used to identify Orchestrator to EdgeConnect devices is not validated Details: The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator. Product affected – All versions affected prior to Silver Peak Unity ECOSâ„¢ 8.3.2+, 8.1.9.12+ and Silver Peak Unity Orchestratorâ„¢ 8.9.2+ 1. Silver Peak product(s) Applicability 2. Unity EdgeConnect, NX, VX Applicable 3. Unity Orchestrator Applicable 4. EdgeConnect in AWS, Azure, GCP Applicable 5. Silver Peak Cloud Services Not Applicable Resolution • Changes have been made to strengthen the initial exchange between the EdgeConnect appliance and the Orchestrator. After the changes, EdgeConnect will validate the certificate used to identify the Orchestrator to EdgeConnect. • TLS itself is continually subject to newly discovered and exploitable vulnerabilities. As such, all versions of EdgeConnect software implement additional out-of-band and user-controlled authentication mechanisms. Any required configuration • Do not change Orchestrator’s IP address as discovered by the EdgeConnect appliance. • Upgrade to Silver Peak Unity ECOSâ„¢ 8.3.2+ or 8.1.9.12+ and Silver Peak Unity Orchestratorâ„¢ 8.9.2+. • In Orchestrator, enable the “Verify Orchestrator Certificateâ€� option under Advanced Security Settings.

Source: CVE-2020-12143