Medium severity5.9NVD Advisory· Published May 21, 2022· Updated Jun 17, 2026
CVE-2022-29222
CVE-2022-29222
Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/pion/dtlsGo | < 2.1.5 | 2.1.5 |
github.com/pion/dtls/v2Go | < 2.1.5 | 2.1.5 |
Affected products
3- ghsa-coords2 versions
< 2.1.5+ 1 more
- (no CPE)range: < 2.1.5
- (no CPE)range: < 2.1.5
Patches
Vulnerability mechanics
References
7- github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-w45j-f832-hxvhghsaADVISORY
- github.com/pion/dtls/releases/tag/v2.1.5nvdRelease NotesThird Party AdvisoryWEB
- github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvhnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2022-29222ghsaADVISORY
- github.com/pion/dtlsghsaPACKAGE
- pkg.go.dev/vuln/GO-2022-0462ghsaWEB
News mentions
0No linked articles in our index yet.