CVE-2022-21656 — Improper Certificate Validation in Envoy

CWE-295 — Improper Certificate ValidationCWE-843 — Type Confusion2 documents2 sources
Severity
5.9MEDIUMNVD
EPSS
0.0%
top 96.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Envoyproxy Envoy
Timeline
PublishedFeb 22
Latest updateFeb 23

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages1 packages

▶NVDenvoyproxy/envoy< 1.20.2

Patches

Patch: github.com ↗Patch: github.com ↗

📋Vendor Advisories

1
Red Hat
envoy: X.509 subjectAltName matching (and nameConstraints) bypass↗2022-02-23
▶
CVE-2022-21656 — Improper Certificate Validation | cvebase