CVE-2022-21654
First published: Fri Feb 04 2022(Updated: )
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/envoy | <1.18.6 | 1.18.6 |
| redhat/envoy | <1.19.3 | 1.19.3 |
| redhat/envoy | <1.20.2 | 1.20.2 |
| redhat/envoy | <1.21.1 | 1.21.1 |
| redhat/servicemesh-proxy | <0:2.0.9-3.el8 | 0:2.0.9-3.el8 |
| redhat/servicemesh-proxy | <0:2.1.2-4.el8 | 0:2.1.2-4.el8 |
| Envoyproxy Envoy | >=1.7.0<1.18.6 | |
| Envoyproxy Envoy | >=1.19.0<1.19.3 | |
| Envoyproxy Envoy | >=1.20.0<1.20.2 | |
| Envoyproxy Envoy | >=1.21.0<1.21.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/envoyproxy/envoy/commit/e9f936d85dc1edc34fabd0a1725ec180f2316353
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
- https://access.redhat.com/errata/RHSA-2022:1276
- https://access.redhat.com/errata/RHSA-2022:1275
- https://access.redhat.com/security/cve/cve-2022-21654
- https://bugzilla.redhat.com/show_bug.cgi?id=2050753
- https://www.cve.org/CVERecord?id=CVE-2022-21654 https://nvd.nist.gov/vuln/detail/CVE-2022-21654 https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283
Frequently Asked Questions
What is CVE-2022-21654?
CVE-2022-21654 is a critical vulnerability found in Envoy, an open source edge and service proxy.
How severe is CVE-2022-21654?
CVE-2022-21654 has a severity rating of 9.4 (critical).
What is the affected software for CVE-2022-21654?
The affected software for CVE-2022-21654 includes Envoy versions 1.18.6, 1.19.3, 1.20.2, 1.21.1, and servicemesh-proxy versions 0:2.0.9-3.el8, 0:2.1.2-4.el8.
How do I fix CVE-2022-21654?
To fix CVE-2022-21654, ensure that you are using the following versions: Envoy 1.18.6, 1.19.3, 1.20.2, 1.21.1, or servicemesh-proxy 0:2.0.9-3.el8, 0:2.1.2-4.el8.
Where can I find more information about CVE-2022-21654?
You can find more information about CVE-2022-21654 on the Red Hat Security Advisory website.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-21654
- agent/software-canonical-lookup
- collector/redhat-cve
- vendor/envoyproxy
- canonical/envoyproxy envoy
- version/envoyproxy envoy/1.7.0
- version/envoyproxy envoy/1.19.0
- version/envoyproxy envoy/1.20.0
- version/envoyproxy envoy/1.21.0
- package-manager/redhat