CVE-2022-21654: Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
A flaw was found in envoy. When certificate validation settings are changed, incorrect configuration handling allows TLS session reuse without revalidation.
Other sources
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-21654?
CVE-2022-21654 is a critical vulnerability found in Envoy, an open source edge and service proxy.
How severe is CVE-2022-21654?
CVE-2022-21654 has a severity rating of 9.4 (critical).
What is the affected software for CVE-2022-21654?
The affected software for CVE-2022-21654 includes Envoy versions 1.18.6, 1.19.3, 1.20.2, 1.21.1, and servicemesh-proxy versions 0:2.0.9-3.el8, 0:2.1.2-4.el8.
How do I fix CVE-2022-21654?
To fix CVE-2022-21654, ensure that you are using the following versions: Envoy 1.18.6, 1.19.3, 1.20.2, 1.21.1, or servicemesh-proxy 0:2.0.9-3.el8, 0:2.1.2-4.el8.
Where can I find more information about CVE-2022-21654?
You can find more information about CVE-2022-21654 on the Red Hat Security Advisory website.