CVE-2022-21654
published 2022-02-22CVE-2022-21654: Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have…
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.06%
60.3th percentile
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | >= 1.19.0 < 1.19.3 | 1.19.3 |
| envoyproxy | envoy | >= 1.20.0 < 1.20.2 | 1.20.2 |
| envoyproxy | envoy | >= 1.21.0 < 1.21.1 | 1.21.1 |
| envoyproxy | envoy | >= 1.7.0 < 1.18.6 | 1.18.6 |
| github.com | pomerium_pomerium | >= 0 < 0.16.4 | 0.16.4 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Multiple security issues in Pomerium's embedded envoy
osv·2022-03-01·CVSS 7.5
[HIGH] Multiple security issues in Pomerium's embedded envoy
Multiple security issues in Pomerium's embedded envoy
Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.
Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.
### Impact
- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted
### Patches
Patched in v0.16.4
### Workarounds
No
### References
[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)
* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer d
GHSA
Multiple security issues in Pomerium's embedded envoy
ghsa·2022-03-01·CVSS 7.5
[HIGH] Multiple security issues in Pomerium's embedded envoy
Multiple security issues in Pomerium's embedded envoy
Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.
Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.
### Impact
- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted
### Patches
Patched in v0.16.4
### Workarounds
No
### References
[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)
* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer d
Red Hat
envoy: Incorrect configuration handling allows mTLS session re-use without re-validation
vendor_redhat·2022-02-22·CVSS 7.4
CVE-2022-21654 [HIGH] CWE-367 envoy: Incorrect configuration handling allows mTLS session re-use without re-validation
envoy: Incorrect configuration handling allows mTLS session re-use without re-validation
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation.
No detection rules found.
No public exploits indexed.
https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
2022-02-22
Published