CVE-2022-21657: X.509 Extended Key Usage and Trust Purposes bypass in Envoy
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-21657?
CVE-2022-21657 is a vulnerability in Envoy that allows it to accept certificates without the necessary extendedKeyUsage.
How does CVE-2022-21657 affect Envoy?
CVE-2022-21657 affects Envoy by not restricting the set of certificates it accepts from the peer to only those with the necessary extendedKeyUsage.
What is the severity of CVE-2022-21657?
CVE-2022-21657 has a severity score of 6.5 out of 10, which is considered medium.
Which versions of Envoy are affected by CVE-2022-21657?
Envoy versions up to and including 1.18.6, 1.19.0 to 1.19.3, and 1.20.0 to 1.20.2 are affected by CVE-2022-21657.
How can I fix CVE-2022-21657 in Envoy?
To fix CVE-2022-21657 in Envoy, update to a version that includes the necessary fix released by the Envoy project.