Vulnerability Details : CVE-2022-21654
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
Products affected by CVE-2022-21654
- cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
- cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-21654
0.21%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 59 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-21654
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
7.4
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
2.2
|
5.2
|
GitHub, Inc. |
CWE ids for CVE-2022-21654
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-21654
-
https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed · Advisory · envoyproxy/envoy · GitHubIssue Tracking;Third Party Advisory
-
https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
CVE-2022-21654 · envoyproxy/envoy@e9f936d · GitHubPatch;Third Party Advisory
Jump to