CVE-2022-21656
This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name.
Does this matter?
Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.
Description
Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 0.67% probability · 50th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295, CWE-843
- Affected
- envoyproxy/envoy
- Source
- security-advisories@github.com
References
- https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64ePatch, Third Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2Issue Tracking, Third Party Advisory
- https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64ePatch, Third Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.