PT-2022-15012 · Envoy · Envoy

Mattklein123 · Published 2022-02-22 · Updated 2024-03-06 · CVE-2022-21657

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Envoy (affected versions not specified)

Description The issue concerns Envoy, an open source edge and service proxy designed for cloud-native applications. In affected versions, Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. As a result, Envoy will trust upstream certificates that should not be trusted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-ENVOY-2022-21657

CVE-2022-21657

GHSA-837M-WJRV-VM5G

Affected Products

Envoy

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21657.json · Exploit
• https://github.com/envoyproxy/envoy/pull/630 · Patch
• https://osv.dev/vulnerability/BIT-envoy-2022-21657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21657 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21657 · Vendor Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g · Note
• https://t.me/cvenotify/27830 · Telegram Post
• https://t.me/cvenotify/27189 · Telegram Post
• https://t.me/cibsecurity/37917 · Telegram Post