CVE-2022-21654

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_MCNA
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
VendorProductVersion
envoyproxyenvoy
1.7.0 ≤
𝑥
< 1.18.6
envoyproxyenvoy
1.19.0 ≤
𝑥
< 1.19.3
envoyproxyenvoy
1.20.0 ≤
𝑥
< 1.20.2
envoyproxyenvoy
1.21.0 ≤
𝑥
< 1.21.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283