Description

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Remediation

References

CVE-2022-21654

Related Vulnerabilities

WordPress Plugin Video Gallery-Best WordPress YouTube Gallery Multiple Vulnerabilities (1.7.6)

OpenSSL NULL Pointer Dereference Vulnerability (CVE-2022-3358)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-25727)

WordPress Plugin BigBlueButton Cross-Site Scripting (2.2.3)

Serendipity Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2016-10752)

Severity

Critical

Classification

CVE-2022-21654 CWE-295 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities