CVE catalog

CVE-2022-29222

snowflake: CVE-2022-29222

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.83% · Oct 25, 2026

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansnowflakesid2.10.1-2fixed
Debiansnowflakeforky2.10.1-2fixed
Debiansnowflaketrixie2.5.1-1fixed
Debiansnowflakebookworm2.5.1-1fixed
Ubuntusnowflakepro1.1.0-1vulnerable
Ubuntusnowflakepro1.1.0-2vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1+esm1vulnerable
Ubuntusnowflakepro1.1.0-2ubuntu0.1+esm2fixed
Ubuntutelegrafpro1.19.2+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.2+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu1vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu2vulnerable
Ubuntutelegrafpro1.21.4+ds1-0ubuntu2+esm2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansnowflakesourcesid2.2.0-1not yet assignedNot reported[1011458]
Debiansnowflakesourceforky2.2.0-1not yet assignedNot reported[1011458]
Debiansnowflakesourcetrixie2.2.0-1not yet assignedNot reported[1011458]
Debiansnowflakesourcebookworm2.2.0-1not yet assignedNot reported[1011458]
Ubuntusnowflakedebpro1.1.0-2ubuntu0.1+esm2Not reportedUBUNTU-CVE-2022-29222Not reported
Ubuntutelegrafdebpro1.21.4+ds1-0ubuntu2+esm2Not reportedUBUNTU-CVE-2022-29222Not reported

[Debian bug #1011458]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-snowflake-dev]Fixed

    Source package: [snowflake]

    Details (2)

    • 2.5.1-1 · all · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

    • 2.5.1-1 · all · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

  • [snowflake-client]Fixed

    Source package: [snowflake]

    Details (2)

    • 2.5.1-1+b3 · amd64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

    • 2.5.1-1+b3 · arm64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

  • [snowflake-proxy]Fixed

    Source package: [snowflake]

    Details (2)

    • 2.5.1-1+b3 · amd64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

    • 2.5.1-1+b3 · arm64 · bookworm

      Fixed · Fixed: 2.2.0-1

      dsa · snowflake · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]