← Back

CVE-2022-21654

nvd nist
Published: Feb 22, 2022Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Affected (4)

Products: Envoyproxy: Envoy
Envoyproxy
1 product
Envoy
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Envoyproxy
Envoy
From 1.19.0 to 1.19.3
Envoy
From 1.20.0 to 1.20.2
Envoy
From 1.21.0 to 1.21.1
Envoy
From 1.7.0 to 1.18.6

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (4)

Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory

Timeline

No history available yet.