PT-2022-19474 · Pion+2 · Pion Dtls+2

Juho Nurminen · Published 2022-05-21 · Updated 2026-01-19 · CVE-2022-29222

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pion DTLS versions prior to 2.1.5

Description The issue affects users that are using Client certificates only. A DTLS Client could provide a Certificate that it doesn't possess the private key for, and Pion DTLS wouldn't reject it. The connection itself is still secure, but the Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5.

Recommendations Upgrade to Pion DTLS version 2.1.5 to receive a patch. There are currently no known workarounds.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-29222

GHSA-W45J-F832-HXVH

GO-2022-0462

USN-7966-1

USN-7966-2

Affected Products

Linuxmint

Pion Dtls

Ubuntu

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29222.json · Exploit
• https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412 · Patch
• https://osv.dev/vulnerability/USN-7966-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29222 · Security Note
• https://ubuntu.com/security/CVE-2022-29189 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7966-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29222 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29222 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w45j-f832-hxvh · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29222 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-29222 · Security Note
• https://osv.dev/vulnerability/USN-7966-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-29222 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7966-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29190 · Vendor Advisory