CVE-2020-5864

Name of the Vulnerable Software and Affected Versions NGINX Controller versions prior to 3.2.0

Description The issue concerns communication between NGINX Controller and NGINX Plus instances, where TLS verification is skipped by default. This affects versions of NGINX Controller prior to 3.2.0.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to ensure TLS verification is properly enforced. As a temporary workaround, consider configuring NGINX Controller to enable TLS verification manually until a patch is applied. Restrict access to NGINX Plus instances to minimize the risk of exploitation.