CVE-2022-29222: fallo de gravedad media en pion dtls
Improper Certificate Validation in Pion DTLS
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.8%
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
pion · dtlsCVEs relacionadas — pion dtls
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-29189MEDIUMBuffer for inbound DTLS fragments has no limitEPSS 2.1%CVE-2022-29190HIGHHeader reconstruction method can be thrown into an infinite loop in Pion DTLSEPSS 1.7%CVE-2026-26014MEDIUMPion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication keyEPSS 0.7%CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%