Vulnerability · Published May 21, 2022 · Assigned by GitHub_M
CVE-2022-29222Improper Certificate Validation in Pion DTLS
Medium 5.9
In plain English
A medium-severity improper certificate validation in dtls from pion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | snowflake | 2.2.0-1 | DEBIAN-CVE-2022-29222 |
| Debian:13 | snowflake | 2.2.0-1 | DEBIAN-CVE-2022-29222 |
| Debian:14 | snowflake | 2.2.0-1 | DEBIAN-CVE-2022-29222 |
| Go | github.com/pion/dtls | 2.1.5 | GHSA-w45j-f832-hxvh |
| Go | github.com/pion/dtls/v2 | 2.1.5 | GO-2022-0462 |
| Go | github.com/pion/dtls/v2 | 2.1.5 | GHSA-w45j-f832-hxvh |
Affected products (as reported)
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh x_refsource_CONFIRM
- https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412 x_refsource_MISC
- https://github.com/pion/dtls/releases/tag/v2.1.5 x_refsource_MISC