Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-21654

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Published

2022-02-22T23:15:11.103

Last Modified

2024-11-21T06:45:09.843

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.4 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-295

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	envoyproxy	envoy	< 1.18.6	Yes
Application	envoyproxy	envoy	< 1.19.3	Yes
Application	envoyproxy	envoy	< 1.20.2	Yes
Application	envoyproxy	envoy	< 1.21.1	Yes

References

https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353 Patch, Third Party Advisory ([email protected])
https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283 Issue Tracking, Third Party Advisory ([email protected])
https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)