id: GO-2022-0462
modules:
    - module: github.com/pion/dtls/v2
      versions:
        - fixed: 2.1.5
      vulnerable_at: 2.1.4
      packages:
        - package: github.com/pion/dtls/v2
          symbols:
            - flight4Parse
          derived_symbols:
            - Client
            - ClientWithContext
            - Dial
            - DialWithContext
            - Resume
            - Server
            - ServerWithContext
            - handshakeFSM.Run
            - listener.Accept
summary: Improper validation of client certificates in github.com/pion/dtls/v2
description: |-
    Client-provided certificates are not correctly validated, and must not be
    trusted.

    DTLS client certificates must be accompanied by proof that the client possesses
    the private key for the certificate. The Pion DTLS server accepted client
    certificates unaccompanied by this proof, permitting an attacker to present any
    certificate and have it accepted as valid.
published: 2022-07-01T20:07:12Z
cves:
    - CVE-2022-29222
ghsas:
    - GHSA-w45j-f832-hxvh
references:
    - fix: https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412