Vulnerabilities > CVE-2022-29222 - Unspecified vulnerability in Pion Dtls

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

pion

NVD

Published: 2022-05-21

Updated: 2024-11-21

Summary

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.

Vulnerable Configurations

Part	Description	Count
Application	Pion Pion Dtls - Pion Dtls 1.0.0 Pion Dtls 1.0.1 Pion Dtls 1.0.2 Pion Dtls 1.1.0 Pion Dtls 1.1.1 Pion Dtls 1.2.0 Pion Dtls 1.2.1 Pion Dtls 1.2.2 Pion Dtls 1.2.3 Pion Dtls 1.3.0 Pion Dtls 1.3.1 Pion Dtls 1.3.2 Pion Dtls 1.3.3 Pion Dtls 1.3.4 Pion Dtls 1.3.5 Pion Dtls 1.4.0 Pion Dtls 1.5.0 Pion Dtls 1.5.1 Pion Dtls 1.5.2 Pion Dtls 1.5.3 Pion Dtls 1.5.4 Pion Dtls 2.0.0 Pion Dtls 2.0.1 Pion Dtls 2.0.2 Pion Dtls 2.0.3 Pion Dtls 2.0.4 Pion Dtls 2.0.5 Pion Dtls 2.0.6 Pion Dtls 2.0.7 Pion Dtls 2.0.8 Pion Dtls 2.0.9 Pion Dtls 2.0.10 Pion Dtls 2.0.11 Pion Dtls 2.0.12 Pion Dtls 2.0.13 Pion Dtls 2.1.0 Pion Dtls 2.1.1 Pion Dtls 2.1.2 Pion Dtls 2.1.3 Pion Dtls 2.1.4	51

Summary

Vulnerable Configurations

References