CVE-2022-21654

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Feb 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-216557.5Envoy is an open source edge and service proxy, designed for cloud-native applications. The envoy common router will segfault if an internalCVE-2022-216565.9Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implCVE-2022-216576.5Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the setCVE-2022-216586.3Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust SeCVE-2022-216595.3Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user CVE-2022-21669.8Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.CVE-2022-216608.1Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higheCVE-2022-216617.5WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatioCVE-2022-216625.4WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticateCVE-2022-216637.2WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with CVE-2022-216648.8WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitCVE-2022-216667.2Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injection