// For flags

CVE-2022-21656

X.509 subjectAltName matching bypass in Envoy

Severity Score

5.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a "type confusion" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.

Envoy es un proxy de borde y servicio de código abierto, diseñado para aplicaciones nativas de la nube. La implementación default_validator.cc usada para implementar las rutinas de comprobación de certificados por defecto presenta un error de "confusión de tipo" cuando procesa subjectAltNames. Este procesamiento permite, por ejemplo, que un rfc822Name o uniformResourceIndicator sea autenticado como un nombre de dominio. Esta confusión permite omitir nameConstraints, tal y como lo procesa la implementación subyacente de OpenSSL/BoringSSL, exponiendo la posibilidad de suplantación de servidores arbitrarios. Como resultado, Envoy confiará en certificados de origen que no deberían ser confiables

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-11-16 CVE Reserved
  • 2022-02-22 CVE Published
  • 2023-09-15 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
  • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Envoyproxy
Search vendor "Envoyproxy"
 Envoy
Search vendor "Envoyproxy" for product "Envoy"
 < 1.20.2
Search vendor "Envoyproxy" for product "Envoy" and version " < 1.20.2"
-
Affected