CVE-2022-29222 Improper Certificate Validation in Pion DTLS

2022-05-2100:00:15

CWE-295

GitHub_M

www.cve.org

cve-2022-29222

improper certificate validation

pion dtls

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

31.1%

JSON

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn’t posses the private key for and Pion DTLS wouldn’t reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can’t be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.

CNA Affected

[
  {
    "product": "dtls",
    "vendor": "pion",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.1.5"
      }
    ]
  }
]