CVE-2022-23462 - Vulnerability Details - OpenCVE

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00099.

Key SSVC decision points have not yet been added.

Vendors	Products
Softmotions	Iowow

Configuration 1 [-]

cpe:2.3:a:softmotions:iowow:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd
https://securitylab.github.com/advisories/GHSL-2022-066_iowow/

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00063}`	epss `{'score': 0.00079}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-10-21T00:00:00.000Z

Updated: 2025-04-22T17:18:13.607Z

Reserved: 2022-01-19T00:00:00.000Z

Link: CVE-2022-23462

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-10-21T22:15:09.540

Modified: 2024-11-21T06:48:36.507

Link: CVE-2022-23462

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-23462", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2025-04-22T17:18:13.607Z", "dateReserved": "2022-01-19T00:00:00.000Z", "datePublished": "2022-10-21T00:00:00.000Z"}, "containers": {"cna": {"title": "Stack Buffer Overflow in iowow", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-10-21T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch."}], "affected": [{"vendor": "Softmotions", "product": "iowow", "versions": [{"version": "1.4.15", "status": "affected", "lessThanOrEqual": "1.4.15", "versionType": "custom"}]}], "references": [{"url": "https://securitylab.github.com/advisories/GHSL-2022-066_iowow/"}, {"url": "https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-120 Buffer Overflow", "cweId": "CWE-120"}]}, {"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-121 Stack-based Buffer Overflow", "cweId": "CWE-121"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "GHSL-2022-066", "defect": ["GHSL-2022-066"], "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:43:45.979Z"}, "title": "CVE Program Container", "references": [{"url": "https://securitylab.github.com/advisories/GHSL-2022-066_iowow/", "tags": ["x_transferred"]}, {"url": "https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-22T15:43:26.534245Z", "id": "CVE-2022-23462", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-22T17:18:13.607Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:softmotions:iowow:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A5227C4-FC98-4CF6-8965-8CA15FEA3695", "versionEndIncluding": "1.4.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the `master` branch of the repository. There are no workarounds other than applying the patch."}, {"lang": "es", "value": "IOWOW es una biblioteca de utilidades en C y un motor de almacenamiento persistente de claves/valores. Las versiones 1.4.15 y anteriores contienen una vulnerabilidad de desbordamiento del b\u00fafer de la pila que permite una Denegaci\u00f3n de Servicio (DOS) cuando analiza los n\u00fameros de notaci\u00f3n cient\u00edfica presentes en JSON. Un parche para este problema est\u00e1 disponible en el commit a79d31e4cff1d5a08f665574b29fd885897a28fd en la rama \"master\" del repositorio. No se presentan m\u00e1s mitigaciones que aplicar el parche"}], "id": "CVE-2022-23462", "lastModified": "2024-11-21T06:48:36.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-21T22:15:09.540", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2022-066_iowow/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2022-066_iowow/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-121"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}