CVE-2022-21654

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-21654
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21654.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-21654
Aliases
Downstream
Published
2022-02-22T22:35:11Z
Modified
2026-05-30T18:31:25.523858Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
Details

Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised to upgrade.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21654.json",
    "cwe_ids": [
        "CWE-295"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/envoyproxy/envoy

Affected ranges

Type
GIT
Repo
https://github.com/envoyproxy/envoy
Events
Introduced
a9d72603c68da3a10a1c0d021d01c7877e6f2a30
Fixed
af50070ee60866874b0a9383daf9364e884ded22

Affected versions

v1.*
v1.21.0

Database specific

vanir_signatures 
[
    {
        "digest": {
            "line_hashes": [
                "245673340480709380475607110780385137708",
                "285494569074532567258474565032572094364",
                "121492910522987967398570563042373873103",
                "208903825150298770882316003860954195851"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-21654-097fed22",
        "signature_version": "v1",
        "target": {
            "file": "source/common/tcp_proxy/tcp_proxy.h"
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/af50070ee60866874b0a9383daf9364e884ded22"
    },
    {
        "digest": {
            "line_hashes": [
                "222375982320279527150068471158201686244",
                "165738277750233846199418982723160704713",
                "44051101608002913249948422506083140770"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-21654-9c39651a",
        "signature_version": "v1",
        "target": {
            "file": "test/integration/tcp_tunneling_integration_test.cc"
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/af50070ee60866874b0a9383daf9364e884ded22"
    },
    {
        "digest": {
            "function_hash": "296559161755360112084384558440136934044",
            "length": 808.0
        },
        "id": "CVE-2022-21654-a6789e61",
        "signature_version": "v1",
        "target": {
            "file": "source/common/tcp_proxy/tcp_proxy.cc",
            "function": "Filter::onDownstreamEvent"
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://github.com/envoyproxy/envoy/commit/af50070ee60866874b0a9383daf9364e884ded22"
    },
    {
        "digest": {
            "line_hashes": [
                "146243477446113422387021212725253250778",
                "48539946143607539866181123457421037495",
                "283468910120726656487263215273247794220",
                "32816829629574534818331468211218975208",
                "167487698232686579647343259536732486616",
                "18932793910309592312745692489877318569",
                "190222441294940987692714025372522320194",
                "233481120278761949454860284316900076892",
                "33182693539138785849824461743826464632",
                "238411867963402661331142337279192022640"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-21654-d54b575d",
        "signature_version": "v1",
        "target": {
            "file": "source/common/tcp_proxy/tcp_proxy.cc"
        },
        "deprecated": false,
        "signature_type": "Line",
        "source": "https://github.com/envoyproxy/envoy/commit/af50070ee60866874b0a9383daf9364e884ded22"
    },
    {
        "digest": {
            "function_hash": "63191530169222520921233896458439701262",
            "length": 711.0
        },
        "id": "CVE-2022-21654-efb2c5e4",
        "signature_version": "v1",
        "target": {
            "file": "source/common/tcp_proxy/tcp_proxy.cc",
            "function": "Filter::onUpstreamEvent"
        },
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://github.com/envoyproxy/envoy/commit/af50070ee60866874b0a9383daf9364e884ded22"
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-21654.json"
vanir_signatures_modified 
"2026-05-30T18:31:25Z"