by Kastro
Paper/Archive/CVE-2022-21654

CVE-2022-21654

envoyproxy envoy — Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Affected

ProductAffectedFixed inSource
envoy>= 1.7.0, < 1.18.6–CNA
envoy>= 1.19.0, < 1.19.3–CNA
envoy>= 1.20.0, < 1.20.2–CNA
envoy>= 1.21.0, < 1.21.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283refgithub.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353