CVE-2022-21657

Published Feb 22, 2022

Last updated 3 years ago

Overview

Description: Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
Source: security-advisories@github.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 4
Impact score: 2.9
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:N/I:P/A:N

Weaknesses

security-advisories@github.com: CWE-295

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0EFC93D0-C206-417C-81D0-F18145E3D768",
            "versionEndExcluding": "1.18.6"
          },
          {
            "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2812AC62-44B5-4077-862D-A221CD88981D",
            "versionEndExcluding": "1.19.3",
            "versionStartIncluding": "1.19.0"
          },
          {
            "criteria": "cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F5441B2D-F807-4ED9-AFB9-ED4DE07CE5F8",
            "versionEndExcluding": "1.20.2",
            "versionStartIncluding": "1.20.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References