PT-2022-15009 · Envoy · Envoy

Mattklein123 · Published 2022-02-22 · Updated 2024-03-06 · CVE-2022-21654

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Envoy (affected versions not specified)

Description The issue concerns Envoy, an open source edge and service proxy for cloud-native applications. It allows the re-use of TLS when certain certificate validation settings have changed from their default configuration. Users are advised to ensure that default TLS settings are used as a workaround. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider ensuring that default TLS settings are used until a patch is available.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-ENVOY-2022-21654

CVE-2022-21654

GHSA-5J4X-G36V-M283

RHSA-2022:1275

RHSA-2022:1276

Affected Products

Envoy

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21654.json · Exploit
• https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21654 · Security Note
• https://osv.dev/vulnerability/BIT-envoy-2022-21654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21654 · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283 · Note
• https://t.me/cibsecurity/37915 · Telegram Post
• https://t.me/cvenotify/27192 · Telegram Post