CVE-2022-29222

 

Published at: - 21-05-2022 02:15

Last modified: - 08-06-2022 05:05

Total changes: - 2

Description

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://github.com/pion/dtls/releases/tag/v2.1.5
• https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412
• https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh

 

Keywords

NVD

 

CVE-2022-29222

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures