PT-2022-19474 · Pion+2 · Pion Dtls+2

Juho Nurminen

·

CVE-2022-29222

·

Published

2022-05-21

·

Updated

2026-01-19

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Pion DTLS versions prior to 2.1.5
Description The issue affects users that are using Client certificates only. A DTLS Client could provide a Certificate that it doesn't possess the private key for, and Pion DTLS wouldn't reject it. The connection itself is still secure, but the Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5.
Recommendations Upgrade to Pion DTLS version 2.1.5 to receive a patch. There are currently no known workarounds.

Exploit

Fix

Improper Certificate Validation

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-29222
GHSA-W45J-F832-HXVH
GO-2022-0462
USN-7966-1
USN-7966-2

Affected Products

Linuxmint
Pion Dtls
Ubuntu