CVE-2022-21654CWE-295

Incorrect configuration handling allows TLS session re-use without re-validation in Envoy

High · published February 22, 2022

CVSS v3.1
7.4
EPSS
1%
Percentile
64.8
In the wild
Unconfirmed
What it is

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01078 · 64.8th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2022-02-22T22:35Z
EPSS history
Timeline
  • 22 FEB 22:35Z
    Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
    cvelistv5