Vulnerability-Lookup

ubuntu-cve-2022-29222

Vulnerability from osv_ubuntu

Published

2022-05-21 00:15

Modified

2026-01-20 05:01

Summary

Details

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-29222	REPORT
	https://github.com/pion/dtls/security/advisories/…	REPORT
	https://github.com/pion/dtls/commit/d2f797183a9f0…	REPORT
	https://github.com/pion/dtls/releases/tag/v2.1.5	REPORT
	https://github.com/pion/dtls/commit/d2f797183a9f0…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-29222	REPORT
	https://ubuntu.com/security/notices/USN-7966-1	ADVISORY
	https://ubuntu.com/security/notices/USN-7966-2	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "snowflake-client",
            "binary_version": "1.1.0-2ubuntu0.1+esm2"
          },
          {
            "binary_name": "snowflake-proxy",
            "binary_version": "1.1.0-2ubuntu0.1+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "snowflake",
        "purl": "pkg:deb/ubuntu/snowflake@1.1.0-2ubuntu0.1+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0-2ubuntu0.1+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1.0-1",
        "1.1.0-2",
        "1.1.0-2ubuntu0.1",
        "1.1.0-2ubuntu0.1+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "telegraf",
            "binary_version": "1.21.4+ds1-0ubuntu2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "telegraf",
        "purl": "pkg:deb/ubuntu/telegraf@1.21.4+ds1-0ubuntu2+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.4+ds1-0ubuntu2+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.19.2+ds1-0ubuntu1",
        "1.21.2+ds1-0ubuntu1",
        "1.21.4+ds1-0ubuntu1",
        "1.21.4+ds1-0ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn\u0027t posses the private key for and Pion DTLS wouldn\u0027t reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can\u0027t be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.",
  "id": "UBUNTU-CVE-2022-29222",
  "modified": "2026-01-20T05:01:32Z",
  "published": "2022-05-21T00:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29222"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pion/dtls/releases/tag/v2.1.5"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-29222"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7966-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7966-2"
    }
  ],
  "related": [
    "USN-7966-1",
    "USN-7966-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-29222"
  ]
}

CVE-2022-29222 (GCVE-0-2022-29222)

Vulnerability from cvelistv5 – Published: 2022-05-21 00:00 – Updated: 2025-04-23 18:23

Title

Improper Certificate Validation in Pion DTLS

Summary

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 14:06 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/pion/dtls/security/advisories/…	x_refsource_CONFIRM
https://github.com/pion/dtls/commit/d2f797183a9f0…	x_refsource_MISC
https://github.com/pion/dtls/releases/tag/v2.1.5	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pion	dtls	Affected: < 2.1.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:17:54.467Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pion/dtls/releases/tag/v2.1.5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29222",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:06:54.695147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:23:10.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dtls",
          "vendor": "pion",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn\u0027t posses the private key for and Pion DTLS wouldn\u0027t reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can\u0027t be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-21T00:00:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pion/dtls/releases/tag/v2.1.5"
        }
      ],
      "source": {
        "advisory": "GHSA-w45j-f832-hxvh",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Certificate Validation in Pion DTLS",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-29222",
          "STATE": "PUBLIC",
          "TITLE": "Improper Certificate Validation in Pion DTLS"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "dtls",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.1.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "pion"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn\u0027t posses the private key for and Pion DTLS wouldn\u0027t reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can\u0027t be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-295: Improper Certificate Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh",
              "refsource": "CONFIRM",
              "url": "https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh"
            },
            {
              "name": "https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412",
              "refsource": "MISC",
              "url": "https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412"
            },
            {
              "name": "https://github.com/pion/dtls/releases/tag/v2.1.5",
              "refsource": "MISC",
              "url": "https://github.com/pion/dtls/releases/tag/v2.1.5"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-w45j-f832-hxvh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-29222",
    "datePublished": "2022-05-21T00:00:15.000Z",
    "dateReserved": "2022-04-13T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:23:10.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-7966-1

Vulnerability from osv_ubuntu

Published

2026-01-19 10:35

Modified

2026-04-27 14:11

Summary

snowflake vulnerabilities

Details

It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189)

It was discovered that Pion DTLS, vendored in Snowflake, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190)

It was discovered that Pion DTLS, vendored in Snowflake, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7966-1	ADVISORY
	https://ubuntu.com/security/CVE-2022-29189	REPORT
	https://ubuntu.com/security/CVE-2022-29190	REPORT
	https://ubuntu.com/security/CVE-2022-29222	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-29189",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-29190",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-29222",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "snowflake-client",
            "binary_version": "1.1.0-2ubuntu0.1+esm2"
          },
          {
            "binary_name": "snowflake-proxy",
            "binary_version": "1.1.0-2ubuntu0.1+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "snowflake",
        "purl": "pkg:deb/ubuntu/snowflake@1.1.0-2ubuntu0.1+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.0-2ubuntu0.1+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1.0-1",
        "1.1.0-2",
        "1.1.0-2ubuntu0.1",
        "1.1.0-2ubuntu0.1+esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit\non the amount of data that was buffered during the handshake. An attacker could\npossibly use the issue to cause a denial of service. (CVE-2022-29189)\n\nIt was discovered that Pion DTLS, vendored in Snowflake, did not prevent the \nfragmentBuffer from processing zero length fragments. An attacker could\npossibly use the issue to cause a denial of service. (CVE-2022-29190)\n\nIt was discovered that Pion DTLS, vendored in Snowflake, did not require \nCertificateVerify when Client Cert was sent. An attacker could\npossibly use the issue to cause a denial of service. (CVE-2022-29222)",
  "id": "USN-7966-1",
  "modified": "2026-04-27T14:11:47Z",
  "published": "2026-01-19T10:35:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7966-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29189"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29190"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29222"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "snowflake vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2022-29189",
    "UBUNTU-CVE-2022-29190",
    "UBUNTU-CVE-2022-29222"
  ]
}

usn-7966-2

Vulnerability from osv_ubuntu

Published

2026-01-19 12:42

Modified

2026-04-27 14:11

Summary

telegraf vulnerabilities

Details

USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the corresponding updates for Telegraf.

Original advisory details:

It was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189)

It was discovered that Pion DTLS, vendored in Telegraf, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190)

It was discovered that Pion DTLS, vendored in Telegraf, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7966-2	ADVISORY
	https://ubuntu.com/security/CVE-2022-29189	REPORT
	https://ubuntu.com/security/CVE-2022-29190	REPORT
	https://ubuntu.com/security/CVE-2022-29222	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-29189",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-29190",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-29222",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "telegraf",
            "binary_version": "1.21.4+ds1-0ubuntu2+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "telegraf",
        "purl": "pkg:deb/ubuntu/telegraf@1.21.4+ds1-0ubuntu2+esm2?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.4+ds1-0ubuntu2+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.19.2+ds1-0ubuntu1",
        "1.21.2+ds1-0ubuntu1",
        "1.21.4+ds1-0ubuntu1",
        "1.21.4+ds1-0ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the\ncorresponding updates for Telegraf.\n\nOriginal advisory details:\n\nIt was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit\non the amount of data that was buffered during the handshake. An attacker could\npossibly use the issue to cause a denial of service. (CVE-2022-29189)\n\nIt was discovered that Pion DTLS, vendored in Telegraf, did not prevent the\nfragmentBuffer from processing zero length fragments. An attacker could\npossibly use the issue to cause a denial of service. (CVE-2022-29190)\n\nIt was discovered that Pion DTLS, vendored in Telegraf, did not require\nCertificateVerify when Client Cert was sent. An attacker could\npossibly use the issue to cause a denial of service. (CVE-2022-29222)\n",
  "id": "USN-7966-2",
  "modified": "2026-04-27T14:11:47Z",
  "published": "2026-01-19T12:42:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7966-2"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29189"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29190"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-29222"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "telegraf vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2022-29189",
    "UBUNTU-CVE-2022-29190",
    "UBUNTU-CVE-2022-29222"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ubuntu-cve-2022-29222

Vulnerability from osv_ubuntu

CVE-2022-29222 (GCVE-0-2022-29222)

usn-7966-1

Vulnerability from osv_ubuntu

usn-7966-2

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour