CVE-2022-2469 - OpenCVE

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Gnu	Gnu Sasl

Configuration 1 [-]

cpe:2.3:a:gnu:gnu_sasl:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:10.0:::::::*
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

No data.

References

Link	Providers
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json
https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30
https://lists.gnu.org/archive/html/info-gnu/2022-07/msg00003.html
https://nvd.nist.gov/vuln/detail/CVE-2022-2469
https://www.cve.org/CVERecord?id=CVE-2022-2469
https://www.debian.org/security/2022/dsa-5189

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2022-07-19T15:53:56

Updated: 2024-08-03T00:39:07.671Z

Reserved: 2022-07-19T00:00:00

Link: CVE-2022-2469

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-07-19T16:15:08.643

Modified: 2022-10-26T02:54:34.367

Link: CVE-2022-2469

Redhat

Severity : Moderate

Publid Date: 2022-07-18T00:00:00Z

Links: CVE-2022-2469 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "GNU SASL", "vendor": "GNU", "versions": [{"status": "affected", "version": ">=0.0.0, <2.0.1"}]}], "credits": [{"lang": "en", "value": "Simon Josefsson"}], "descriptions": [{"lang": "en", "value": "GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Out-of-bounds read in GNU SASL", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-07-25T02:06:13", "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json"}, {"name": "DSA-5189", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2022/dsa-5189"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@gitlab.com", "ID": "CVE-2022-2469", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "GNU SASL", "version": {"version_data": [{"version_value": ">=0.0.0, <2.0.1"}]}}]}, "vendor_name": "GNU"}]}}, "credit": [{"lang": "eng", "value": "Simon Josefsson"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client"}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Out-of-bounds read in GNU SASL"}]}]}, "references": {"reference_data": [{"name": "https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30", "refsource": "MISC", "url": "https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30"}, {"name": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json", "refsource": "CONFIRM", "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json"}, {"name": "DSA-5189", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2022/dsa-5189"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:39:07.671Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json"}, {"name": "DSA-5189", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2022/dsa-5189"}]}]}, "cveMetadata": {"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "assignerShortName": "GitLab", "cveId": "CVE-2022-2469", "datePublished": "2022-07-19T15:53:56", "dateReserved": "2022-07-19T00:00:00", "dateUpdated": "2024-08-03T00:39:07.671Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:gnu_sasl:*:*:*:*:*:*:*:*", "matchCriteriaId": "08CC0659-9CC8-4A5F-AEF7-251CE9AC31C5", "versionEndExcluding": "2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client"}, {"lang": "es", "value": "GNU SASL libgsasl lectura fuera de l\u00edmites del lado del servidor con cliente GSS-API autenticado malicioso"}], "id": "CVE-2022-2469", "lastModified": "2022-10-26T02:54:34.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2022-07-19T16:15:08.643", "references": [{"source": "cve@gitlab.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2469.json"}, {"source": "cve@gitlab.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30"}, {"source": "cve@gitlab.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5189"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}