GitHub Advisoryadvisory · Go

GHSA-w45j-f832-hxvh Pion/DLTS Accepts Client Certificates Without CertificateVerify

MEDIUM Published 2022-05-25 Modified 2023-08-29 Official page ↗
Aliases
CVE-2022-29222
Ecosystem
Go
Packages
github.com/pion/dtls, github.com/pion/dtls/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2022-05-25

Affected packages

• Go github.com/pion/dtls: < 2.1.5 → fixed in 2.1.5 • Go github.com/pion/dtls/v2: < 2.1.5 → fixed in 2.1.5

Description

Impact A DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 Patches Upgrade to Pion DTLS v2.1.5 Workarounds No workarounds available, upgrade to Pion DTLS v2.1.5 References Thank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more information If you have any questions or comments about this advisory: • Open an issue in Pion DTLS • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-29222 Pion DTLS is a Go implementation of Datagram Transport Layer Security. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References