Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29222

CVE-2022-29222:
Pion/DLTS Accepts Client Certificates Without CertificateVerify

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29222
GHSA ID
GHSA-w45j-f832-hxvh
EPSS Score
0.56357%
CWE
CWE-295
Published
5/25/2022
Updated
8/29/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/pion/dtlsgo< 2.1.52.1.5
github.com/pion/dtls/v2go< 2.1.52.1.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper certificate validation in the DTLS handshake process. The flight4Parse function in flight4handler.go was modified in the patch to add a check (lines 92-95) that prevents cipher suite initialization without CertificateVerify when client certificates are present. The associated test (flight4handler_test.go) explicitly verifies this failure scenario. The affected package entry points (Client, Server, etc.) ultimately rely on this handshake processing logic, making flight4Parse the core vulnerable function that failed to validate certificate ownership proof.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * *TLS *li*nt *oul* provi** * **rti*i**t* t**t it *o*sn't poss*s t** priv*t* k*y *or *n* Pion *TLS woul*n't r*j**t it. T*is issu* *****ts us*rs t**t *r* usin* *li*nt **rti*i**t*s only. T** *onn**tion its*l* is still s**ur*. T** **rti*i**

Reasoning

T** vuln*r**ility st*ms *rom improp*r **rti*i**t* `v*li**tion` in t** *TLS **n*s**k* `pro**ss`. T** `*li**t*P*rs*` *un*tion in `*li**t***n*l*r.*o` w*s mo*i*i** in t** p*t** to *** * ****k (lin*s **-**) t**t pr*v*nts *ip**r suit* initi*liz*tion wit*ou