CVE-2022-21657 X.509 Extended Key Usage and Trust Purposes bypass in Envoy
Envoy fails to validate Extended Key Usage in TLS certificates, allowing attackers to bypass trust restrictions using non-TLS certificates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21657?
CVE-2022-21657 is a medium-severity vulnerability in Envoyproxy Envoy, published on 22 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Envoy is an open source edge and service proxy, designed for cloud-native applications. In affected versions Envoy does not restrict the set of certificates it accepts from the peer, either as a TLS client or a TLS server, to only those certificates that contain the necessary extendedKeyUsage (id-kp-serverAuth and id-kp-clientAuth, respectively). This means that a peer may present an e-mail certificate (e.g. id-kp-emailProtection), either as a leaf certificate or as a CA in the chain, and it will be accepted for TLS. This is particularly bad when combined with the issue described in pull request #630, in that it allows a Web PKI CA that is intended only for use with S/MIME, and thus exempted from audit or supervision, to issue TLS certificates that will be accepted by Envoy. As a result Envoy will trust upstream certificates that should not be trusted. There are no known workarounds to this issue. Users are advised to upgrade.
Weakness: CWE-295
Which versions are affected by CVE-2022-21657?
1 open source package ship an affected version, including envoy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
envoy Bitnami | All versions | 1.18.6, 1.19.3, 1.20.2 |
Products include Envoyproxy Envoy.
How do I fix CVE-2022-21657?
Upgrade envoy to a fixed version for your release line: 1.18.6, 1.19.3 or 1.20.2.
Is CVE-2022-21657 being exploited?
There is no known exploitation of CVE-2022-21657 in the wild and no public exploit code.
Other vulnerabilities in Envoyproxy Envoy
Sources
Also known as BIT-envoy-2022-21657, GHSA-837m-wjrv-vm5g.