{"id":"CVE-2022-21656","summary":"X.509 subjectAltName matching bypass in Envoy","details":"Envoy is an open source edge and service proxy, designed for cloud-native applications. The default_validator.cc implementation used to implement the default certificate validation routines has a \"type confusion\" bug when processing subjectAltNames. This processing allows, for example, an rfc822Name or uniformResourceIndicator to be authenticated as a domain name. This confusion allows for the bypassing of nameConstraints, as processed by the underlying OpenSSL/BoringSSL implementation, exposing the possibility of impersonation of arbitrary servers. As a result Envoy will trust upstream certificates that should not be trusted.","aliases":["BIT-envoy-2022-21656","GHSA-c9g7-xwcv-pjx2"],"modified":"2026-08-12T12:59:42.250458Z","published":"2022-02-22T22:25:11Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21656.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21656.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-c9g7-xwcv-pjx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21656"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"fixed":"4aaf9593152c6996b9da384c8918e9ad4f0abd4d"},{"fixed":"bb95af848c939cfe5b5ee33c5b1770558077e64e"}],"database_specific":{"cpe":"cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.20.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.20.1","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-21656.json","vanir_signatures_modified":"2026-08-12T12:59:42Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/extensions/transport_sockets/tls/cert_validator/default_validator.h"},"deprecated":false,"digest":{"line_hashes":["132789024205166620906544574782909140344","162361898740986149633848883380742042836","205077998420337888643939838141324541764","5122464635558077072648172130828172168","233799679190448094642711900567157611694","310131979780974588050024577023084235127","253596120226457450919392074581054859452","228584648557361533067410530380154634270","116556119578422112661256274970422125718","186587522839873281658612949993042502425","143389101199250864456466369402097001690","336716705212957174326919781500877194681","109190298136172871184037767732274832242","138290429251636587803380512600969498599","309282824876101919226919918538201053754","257062183441357474698557129206833152743","100251828992962148526608975757090880021","63626608974093729100588531915380735368","175292083845123858323218199559990530980","244061027302979469720672101897550999428","178619501571340648517019182144413388628","115190046525302843900016138124209547652","88009785618186352259792762338094053948","82781599828634929113769569466942073353","278546055197350233650233942795150167429","67593050201816631846403606840887092231","186665351036268561031847150709876647617"],"threshold":0.9},"id":"CVE-2022-21656-06f84d21"},{"deprecated":false,"digest":{"function_hash":"294491040427107176754181314899427291486","length":2958},"id":"CVE-2022-21656-08e4349e","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/upstream/upstream_impl_test.cc","function":"TEST_F"}},{"digest":{"line_hashes":["340042651093604958356579730414112047960","113848818188990292220802582118157818930","268293521087305407416918677236945753002","334558914299746324302293221203526025795","304123924507731075673917980473472097997","97342008689366389375519209086562014370","8729235488258657720198783164632482029","339276342896836986922600874446567649374","44010212989906392561007838405636410369","204216807503252383787875646972960051995","64069585759039811222008280132167471429","110244514348968437544106118549601245976"],"threshold":0.9},"id":"CVE-2022-21656-0c6742dd","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/config/utility.h"},"deprecated":false},{"target":{"file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"93536340456662698298625777278373531574","length":548},"id":"CVE-2022-21656-0d51bc47","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/secret/sds_api_test.cc"},"deprecated":false,"digest":{"line_hashes":["250805495863702010183527845094638447204","115656751048398591376869622619260123399","316552804769710608380640044544284056225","236167281612820933048202647797200632389","123500235463334893379976382201383194467","267137901874792638083754893369187993134","288698204579709416558773112849413165224","46220959298413567202488395386637703017","269324841054414817217135049692298109156","314319097216669819492500721549741514699","223791961872236639581640950555638302578","110820691528573853636573244011497793946","165879193732540839888012765339031134175"],"threshold":0.9},"id":"CVE-2022-21656-0f9a909e","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["141405013819901071302763314298668290955","310136390601092582989617864483884528801","210621560195573215110538764206651794156","29888289589879279916865695848074234062","233036264645288627488692865758118975347"]},"id":"CVE-2022-21656-1116dd98","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/mocks/ssl/mocks.h"}},{"deprecated":false,"digest":{"function_hash":"115983407315052956453306789580188725927","length":1855},"id":"CVE-2022-21656-136c7b0f","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/ads_integration.cc","function":"AdsIntegrationTest::initializeAds"}},{"digest":{"line_hashes":["167183943035979082144787303517563843348","237470289534962168859857656869685353167","133582759750027984409923852839977429295","174032011305409710820319625281849851871"],"threshold":0.9},"id":"CVE-2022-21656-191aa901","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/quic/envoy_quic_proof_source_test.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc"},"deprecated":false,"digest":{"line_hashes":["146602398155677119924680905143348053651","2405009423465571288892555913349691629","159619023947974623997317219061503603702","165066808573696926441392109675405356077","307396868941379693753284272330473386462","18762442527941938070765635789542449927","112129650741939116001547143468606514472","62197628449614385990863777021361672035","282862335981756320132856375961927593824","66239153139737480929162458382765265321","20484862931719654756354426622146494304","6301621451841547709776346666734713245","280958275367053443182730830442720538515","223806271234802523021061016499458327744","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2022-21656-1bf6be10"},{"deprecated":false,"digest":{"line_hashes":["11513961900712448295013672147908776585","60163106350401302403448586018666450473","80568395570260884000219718470690074733","109597916605755918563659658209268735929","95652497088949546523240096137344250067","318903378842435274515500891863272985768","306854273444657340927240662993453474887","191025342649886440500010665635464754201","270066837850980385754820564150312214981","286603662418277649761256600794745167045","300277326958201671887284979301266538878","193375564200342512057160970030609979897","34762855639890478617630099209818786417","201236887155428057474695628636813336044","280857907078886788707229297939752811297","36524200575077406126826955226937734578","34762855639890478617630099209818786417","201236887155428057474695628636813336044","280857907078886788707229297939752811297","62858260757976640106305724952420306761"],"threshold":0.9},"id":"CVE-2022-21656-1e73330a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/ssl_socket_test.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/config/utility.cc"},"deprecated":false,"digest":{"line_hashes":["96632323836511417294976346168151020473","103064241203463898257135685779200372255","61726043141709259988757281974226690708","228656749481925792576257732065875090045","277136674936328762667151743242986761442"],"threshold":0.9},"id":"CVE-2022-21656-25214e68","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/ssl_utility.cc","function":"initializeUpstreamTlsContextConfig"},"deprecated":false,"digest":{"function_hash":"230596584965675008708983698323985265273","length":2265},"id":"CVE-2022-21656-2d6be949","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"156360438879436848698524935026925218326","length":1522},"id":"CVE-2022-21656-3c2801da","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"function":"TEST_F","file":"test/server/listener_manager_impl_quic_only_test.cc"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/ssl_socket_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"184527646058822364550661221401675098659","length":758},"id":"CVE-2022-21656-3da0b2a0","signature_type":"Function"},{"id":"CVE-2022-21656-45af39ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/common/ssl/certificate_validation_context_config_impl.cc","function":"CertificateValidationContextConfigImpl::CertificateValidationContextConfigImpl"},"deprecated":false,"digest":{"function_hash":"220905204156610628339086531854161674708","length":2022}},{"deprecated":false,"digest":{"function_hash":"117482638046502517424243620455275930364","length":537},"id":"CVE-2022-21656-4b6e50de","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc","function":"TEST"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"function":"TEST_F","file":"test/extensions/transport_sockets/tls/context_impl_test.cc"},"deprecated":false,"digest":{"function_hash":"210284115112385036248828451994497676524","length":57200},"id":"CVE-2022-21656-579b44b9"},{"deprecated":false,"digest":{"line_hashes":["293628537620860478657553210436513095863","266985545392986608999917265982939245707","21812831295926434001612911032825033463","176995118030731872018089524605657183630","74332855770574473614495545578857572500","64445122120844926919656982861017160862","50386469160270962231904929736843534139","92124820736339815167079175284931704490","171535135607014588532024744045745257869","89524663704314812583781574359218085592","151145579597045323875480221923330435829","64489064210344043776856347050381513548","148345719194934952991428238342420584659"],"threshold":0.9},"id":"CVE-2022-21656-59d1f11b","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/xfcc_integration_test.cc","function":"XfccIntegrationTest::initialize"},"deprecated":false,"digest":{"function_hash":"118500010402711795995638156286530010503","length":1290},"id":"CVE-2022-21656-5bd67989"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/ssl_socket_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"length":765,"function_hash":"301799889533819109260827649440935692493"},"id":"CVE-2022-21656-6b4f9b1f"},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/ssl_socket_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"22985025237686945030394354140061154114","length":1161},"id":"CVE-2022-21656-74c99be7","signature_type":"Function","signature_version":"v1"},{"target":{"file":"source/common/conn_pool/conn_pool_base.cc","function":"ConnPoolImplBase::checkForIdleAndCloseIdleConnsIfDraining"},"deprecated":false,"digest":{"function_hash":"43013079311173114698727080572662162328","length":338},"id":"CVE-2022-21656-750e7fbb","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d","target":{"file":"source/common/conn_pool/conn_pool_base.h"},"deprecated":false,"digest":{"line_hashes":["238363169343804913942300291017684487943","281075802092293195505541183629950851527","190309091056183134939303314630437286332","1336839216182560585869212455485126136","91854374677920975889051724337189261314","176073550574850004587196271703191506168","54303611712421497849276770032572170236","89596254872871249889385232134194772639","232868586170569298338666905475474416875","68418232771506422252069681807775341343"],"threshold":0.9},"id":"CVE-2022-21656-75516c6f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/common/ssl/certificate_validation_context_config_impl.h"},"deprecated":false,"digest":{"line_hashes":["171741662589997207838121982449748040035","192324539472075829919851153271309615197","131398995659877714704677505412951855920","82307502998785536058874194236101075595","296392438083105141955329425953737440470","141010975301519723383346059034917709112","227484400677674745858147768939777936587","72027376240070323288752216882594934856","217192804651901545203463964689088331619","36930977013248092663532561068259978913","202212162183859651205100763204756622646","99131458260631368037689842218130242693","330196014163242992635494479381367536501","261477060587235171595020027167587792412","95405355815121234751076740709251296561","270701699117839533911669794828836028832","277845567241438864346925939557576289706"],"threshold":0.9},"id":"CVE-2022-21656-7ab115f3"},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.h"},"deprecated":false,"digest":{"line_hashes":["14624907186144965585666734071864647447","324251818482322415326005733700387116738","96785770151459403313354153925210225302","85534751501670791223028608488993363513","258936273307847661153761668025628876378","265573994172129795916563841846893039851","201764047808705237949970542770334557087","288306050910140874834125513884804856034"],"threshold":0.9},"id":"CVE-2022-21656-7f32271b","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["101411751761024135301555776535881360291","57330283011954222224658310473099448203","181204114666477838273960418483979084232","251252316058997536670703428927890836058","250258533175368040685881805797526239446","13288651751650822248661637418651713281","175485210908986240940140195293852154431","316806306044959526406969954137755152102"],"threshold":0.9},"id":"CVE-2022-21656-880b21cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"envoy/ssl/certificate_validation_context_config.h"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc","function":"TEST"},"deprecated":false,"digest":{"function_hash":"188486578328449036635065690446461715196","length":533},"id":"CVE-2022-21656-95f72621","signature_type":"Function"},{"target":{"file":"source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc","function":"SPIFFEValidator::matchSubjectAltName"},"deprecated":false,"digest":{"function_hash":"62049909178980996553601586005825664779","length":598},"id":"CVE-2022-21656-a354c5c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"},{"target":{"function":"TEST_P","file":"test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc"},"deprecated":false,"digest":{"function_hash":"6116264609259420869693390192282911503","length":769},"id":"CVE-2022-21656-a467d563","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"},{"id":"CVE-2022-21656-a575e173","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/extensions/transport_sockets/tls/cert_validator/default_validator.cc"},"deprecated":false,"digest":{"line_hashes":["54564629694760195982947230780491657114","228612393067638111425634484662643704024","216691133557586960713817658759860636611","26223319916055044045779732228532507996","216413347813086265254913236952098643645","239062346477181517044918476712969976666","208563114348252645999708123544539820362","80008305278927706075010404669195759115","305517801619897765774150491635199853076","284179141516247725039832119121212802509","58372300885923414521151785625649597527","21759992954563442163489109158744040387","81856975586078625342997816151715931912","176113994434625413982169062313160094702","41503853353785726859686133276369241134","225965533673573083828945371679376123507","125493085520607899887416250055734317078","316307211849007420581210415495278457312","101591573009782148315352004905072615112","137647712702162297666126313134279429305","97335461251945599657401546136895056997","172309178275924703319046540022142259601","129542366942457379918121584377704374777","299203048436054575066827659393080718418","182933503253997760171839986856220402511","339919906079881159559403501893026320642","105321940155144874940325164207418222542","211105497696029639213028799735037039334","194611972653936564559560809697275216714","169006597490565503311958167411564927584","324813765963233193667598095124053619049","205034656466576001386701320575549505091","255414900372663924134471736190116550090","287173783984360261043265245799048011165","116877514630221476953294015951540033088","10208158768564605281991493255431502158","300760383198987540803137996282995153787"],"threshold":0.9}},{"digest":{"function_hash":"254335498375455677955547749568138330745","length":522},"id":"CVE-2022-21656-a6f4d6b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc","function":"TEST"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/server/listener_manager_impl_quic_only_test.cc"},"deprecated":false,"digest":{"line_hashes":["269913384619888851641381619425924255769","214001561107224651943730262415160760881","316118708481198356098675131288107470398","320823172009576213166680616062612716612","67776816150693049999918516040441679993","107381737988078885521691054004221724610","269913384619888851641381619425924255769","214001561107224651943730262415160760881","316118708481198356098675131288107470398","20915670190021467996322277404295161336","25014179122523392541184133833250296084","173462868030545229492629140285234879270"],"threshold":0.9},"id":"CVE-2022-21656-a93ca3cc","signature_type":"Line"},{"id":"CVE-2022-21656-acfa1e55","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/xfcc_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["241100988771897334492640920943661485265","132927217162735626416339150269235254880","221329311757294107229257013912386976251","250902621172830716120434080275496706583","19548066736493393939418491378651635777","301199746472702176918496529280221035247","213147625237794613980711417184853246009","283903196818545645507182450912165028963","186326317876606759875998616223182460689","92024839105232596622511000205269977327","42528387954191520833311996241104938591","293207472359917078854781266442169992726","126022816866583466871033515253164272730","247788763705416146681136864708290139500","308967584650453255340596161449200154199","295160123484699405206250926419209299514","248576755721266154657213073988728821547","163339083595121184524229705558381586506","277810913474123081690111321875773723121","146783336173930844893786100684025296484","63253980039777729823084891560294329847"],"threshold":0.9}},{"id":"CVE-2022-21656-afd4289a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"171488893832219690313461823133804144704","length":1021}},{"digest":{"line_hashes":["163339083595121184524229705558381586506","211456033896811588912076193214122249676","122638324512319679614842322723110796412","29788868068663203821877116742334743895"],"threshold":0.9},"id":"CVE-2022-21656-b3ef1add","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/ads_integration.cc"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["19648073030515962033240696727079622219","60087692772966804350941950437306713049","309968425356753505926376390543811355073","228571686266295513433095234168924075785","336051926954045588881657584625220929812"],"threshold":0.9},"id":"CVE-2022-21656-b8840255","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/ssl_utility.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/ssl_socket_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"length":1218,"function_hash":"250009548620242763869987295516101920889"},"id":"CVE-2022-21656-bae8c0d4"},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/integration/xfcc_integration_test.cc","function":"XfccIntegrationTest::createClientSslContext"},"deprecated":false,"digest":{"function_hash":"12478039373607567664965060903806123046","length":2897},"id":"CVE-2022-21656-bf1f2744","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["97652407307682118633090827808836069896","202222073443799289957911450767890213833","115564202354952612799820744008677299818","100865938374520508671052066897428637482","266358857140130331037141171435995735386","241277250285489246241581928533925069698","112864798336767260895615422020255373801","326344252156913283305823248376635974319","149501076714298581724217944116072240117","20851967513280832025446682514306651511","101660301215173511645125806388931558046","161983258376373368998625288716073445864","125013157627477663648794220335175813129","114297756736507093046297363714182913184","326342629182717535494243166437244508087","129503348076797258550455082149053172774","6063454819406071701935832397149074681","25450544109902264946434894665349483615","14209541420216802153449926603071335280","28083104488430351869423149520385632380","27329837804645812211356628610675816305"],"threshold":0.9},"id":"CVE-2022-21656-bf50e605","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d","target":{"file":"test/integration/cds_integration_test.cc"}},{"deprecated":false,"digest":{"function_hash":"125611150405076638928061972154736587079","length":1231},"id":"CVE-2022-21656-bfe43a10","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc","function":"TEST"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/secret/sds_api_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"259842000639093783236109568925150900713","length":2528},"id":"CVE-2022-21656-c184f5b3"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/server/listener_manager_impl_quic_only_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"116603796809931456705897296225604281348","length":2037},"id":"CVE-2022-21656-c453d644"},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.cc","function":"SPIFFEValidator::SPIFFEValidator"},"deprecated":false,"digest":{"function_hash":"31070765097408482213883143983173072720","length":2270},"id":"CVE-2022-21656-c5ed99c4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"4472840747587739069332812701688539789","length":3542},"id":"CVE-2022-21656-c6d70210","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/server/listener_manager_impl_quic_only_test.cc","function":"TEST_F"}},{"deprecated":false,"digest":{"function_hash":"8753233862723253082190328791781743962","length":1797},"id":"CVE-2022-21656-c95c0db1","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/upstream/upstream_impl_test.cc","function":"TEST_F"}},{"digest":{"length":851,"function_hash":"19467233466884135759706602442535538532"},"id":"CVE-2022-21656-ca89104c","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"function":"TEST_F","file":"test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"51700461929361369804855949134339317841","length":518},"id":"CVE-2022-21656-d5aa8aef","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"function":"TEST","file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc"}},{"id":"CVE-2022-21656-d5b85f3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator.h"},"deprecated":false,"digest":{"line_hashes":["105927382795573833200003791343384315219","310131979780974588050024577023084235127","208214498123638743716801777519534008036","178906014404373090758464999947216721","231783019248921772702667689359800094330","327676185753872155787133453453496262612","334375235216867276946923551018454678032","172029840023544776779070239686422947468","213348994666355981853349139004095208558"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"206688999278477641178868476553522274921","length":1651},"id":"CVE-2022-21656-da56c2fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/server/listener_manager_impl_quic_only_test.cc","function":"TEST_F"}},{"source":"https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d","target":{"file":"source/common/conn_pool/conn_pool_base.cc","function":"ConnPoolImplBase::closeIdleConnectionsForDrainingPool"},"deprecated":false,"digest":{"function_hash":"83990222759686494038875668905777786185","length":528},"id":"CVE-2022-21656-dc8d3820","signature_type":"Function","signature_version":"v1"},{"target":{"file":"test/common/upstream/upstream_impl_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"64207516507540956133704441850267709535","length":2334},"id":"CVE-2022-21656-de90615d","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"},{"deprecated":false,"digest":{"line_hashes":["99034946478192093250665999305100729412","192463123152691783405275298574218295386","270741318062035816778580779248506543591","270733116414095761737843177330974660834","81863107821511478753143901649957180868","85347115106276858425098093487578584851","99034946478192093250665999305100729412","192463123152691783405275298574218295386","270741318062035816778580779248506543591","270733116414095761737843177330974660834","81863107821511478753143901649957180868","85347115106276858425098093487578584851"],"threshold":0.9},"id":"CVE-2022-21656-df6939da","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/upstream/upstream_impl_test.cc"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/extensions/transport_sockets/tls/cert_validator/default_validator.cc","function":"DefaultCertValidator::initializeSslContexts"},"deprecated":false,"digest":{"length":3917,"function_hash":"18319763665855724781779229955886680506"},"id":"CVE-2022-21656-e613aeda"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/ssl_socket_test.cc","function":"TEST_P"},"deprecated":false,"digest":{"function_hash":"311398350198097227785411915566563511153","length":864},"id":"CVE-2022-21656-eaf96fce","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["315078341025478935700512039286955575171","270192082423273963311216559672998174066","204113856245351511428276676844690086443","174700900408813736208413803546984537404","80014999258786085336020982027090779696","302445940521463351792771024585952969974","225338500573130248788631432651751498693"],"threshold":0.9},"id":"CVE-2022-21656-eb18793a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/context_impl_test.cc"}},{"source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/spiffe/spiffe_validator_integration_test.cc"},"deprecated":false,"digest":{"line_hashes":["251223923539583668908854818827088064695","213340276139818030188837194172397361091","8244557901700234044456171576446491726","130398308216150328525816300689424968332","320108348597165046427946199972068608211","145846596957261126945873491294026779659","153859787761903734880061337598436693327","149329793002655734457328180354485764467","184183867022667248394762237475645269332","43409299751482339911631429861270030470","331146074940755410253454738193090703753","22657765779286994436980139065541752286","301925784546448031784254319281037884342","200823535660057158768001378333168443478"],"threshold":0.9},"id":"CVE-2022-21656-ec522c17","signature_type":"Line","signature_version":"v1"},{"target":{"file":"test/common/quic/envoy_quic_proof_verifier_test.cc"},"deprecated":false,"digest":{"line_hashes":["3132981878602636311018436644251135546","2992615992485088622213500802687037703","188933514757072331220463729576795354932","98137628017153055604701718420091950188"],"threshold":0.9},"id":"CVE-2022-21656-eed710bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"},{"id":"CVE-2022-21656-ef364079","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/upstream/upstream_impl_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"55083073557621866083751227315289054758","length":2207}},{"deprecated":false,"digest":{"line_hashes":["257167495350177217345266481978312437534","12143958127681352296959336062667435006","339197088464978999102751784138506550769","6493262277856911875326956902241758377","121528036476538091297206972748194982131","183545241764783988633021426003544188933","328417139676487519902425575666736587719","337173369509260769703789478395196356919","218204930821860900386331227161516489571","327641756769353748215608114355344113988","285469501622471445140381284133626356571","50292966312729827029435537709635935021"],"threshold":0.9},"id":"CVE-2022-21656-ef648c78","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/extensions/transport_sockets/tls/cert_validator/test_common.h"}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/4aaf9593152c6996b9da384c8918e9ad4f0abd4d","target":{"file":"source/common/conn_pool/conn_pool_base.cc"},"deprecated":false,"digest":{"line_hashes":["211063805449318930197667500157467379330","238149429280769817104751274898789662521","155508904057016497276277837828561242331","306263256694188145409853147140795887683","24621026682503930056724633583760538450","210759516705868193041331552012792706907","268100365964683135363265243678321089408","116993638250131326183953285211810091083","57246520075670457973995740670893215413","194433285147185661463287816608904302305","245699478661219870215728951569204544048","286440446911758131586479113237388457926","33382072507043576477734303938545662581","298229981597606534667320296045042459684","173090808602105440099610064642968627733","210942585548006467924962946211585504886","193341038770066763728097793037333651465","340006873902019806079016649741212930377","286206063645562425499514746822691310145","291017590637862723045538078816014658015"],"threshold":0.9},"id":"CVE-2022-21656-f0c98cd4","signature_type":"Line"},{"target":{"file":"test/extensions/transport_sockets/tls/cert_validator/default_validator_test.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["234571074182748521947942060576597806958","172062331328921553375844288878568262987","266081445499659902776581280811649871609","316598909240170619655011905532080783398","19090884546650958150351995955796620635","256226017955860744823705733706163664564","339887276079595760019455575676052487255","175071083286451842884197782181772676804","290553860653476055665348075176792830069","75214871043391980094189629048825338311","195953648268054706069711356239247191456","245130624990550455777934525477558449753","336996457505493027735907864436118666163","110773936649530507642485037208446242351","259417009747205726336998634697930223441","96372360258504017993322956119486942157","13273322606299519530178091917080790246","271714792682590719510734971033774004024","175071083286451842884197782181772676804","290553860653476055665348075176792830069","90013497752239073298137030924499372429","256343160143241709430968484588585315154","37220966070330417523380607332586132816","154517699279547650412409850727102985984","37408050379650719967714188034572982093","196086709894302991284831872778664835073","267030271147516053565175438762776686198","157175822956108394107036888633689556418","12754486495970096547261044823417543668","196296983021575602516093215709078202180","165847467047849310102923660416063582955","175071083286451842884197782181772676804","290553860653476055665348075176792830069","41565497878896949670191877895914127156","29947834786498364869486642481423417853","332870176450105604663680850458774647699","167962706844911888577279476022816362993","270724342143690024787355103134396108862","37408050379650719967714188034572982093","196086709894302991284831872778664835073","134186365654200424747792540510151339496","316598909240170619655011905532080783398","319804850163798738486954201653369405980","270891529237430564677909512225176496962","59222763738998225234118260664201903390","152119820861509847252954568887199350810","55374266318845193860202173107490343311","23341379815679482616245184417445547237","98996969636650495726727674979231731227","249275753758335178011182555329007539230","70904456150849324644680206189671825362","267356261243732934248911673010170168180","335392768486221278090285886766983609452","289821452549559100840303268182158289362","222495876667529862625700900614434149555","78810666425104140167967535942497258603","108587633537507210242609878158511307392"]},"id":"CVE-2022-21656-f2ed1663","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e"},{"deprecated":false,"digest":{"line_hashes":["302536837169827296103571385783065626110","329003654876841636082806336478556044230","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2022-21656-f6704bb2","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/common/secret/secret_manager_impl_test.cc"}},{"deprecated":false,"digest":{"line_hashes":["329256264563729553640363482499231985166","297443981130819865535634597355134880629","185618092965657444281893602795514722671","8607270988621463149244312484253108445","44284602681364427200227033468350763637","55658838715716127340345769049641848862","316984035992243664648279429649086916369","218806251490770606860874878351805143508","144578169445208252805502975845109008218","240561719534594337641923367926857380868","108587633537507210242609878158511307392","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2022-21656-fc38a9c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"source/common/ssl/certificate_validation_context_config_impl.cc"}},{"id":"CVE-2022-21656-ff08f2f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/bb95af848c939cfe5b5ee33c5b1770558077e64e","target":{"file":"test/config/utility.cc","function":"ConfigHelper::initializeTls"},"deprecated":false,"digest":{"function_hash":"114302095951309377401950087995390851329","length":2296}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}