CVE-2022-29240

{"containers": {"cna": {"affected": [{"product": "scylla", "vendor": "scylladb", "versions": [{"status": "affected", "version": "< 4.6.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.3"}]}], "descriptions": [{"lang": "en", "value": "Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-15T21:20:10.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/scylladb/scylladb/issues/11476"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb"}], "source": {"advisory": "GHSA-25pq-rrqm-6fmr", "discovery": "UNKNOWN"}, "title": "Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-29240", "STATE": "PUBLIC", "TITLE": "Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "scylla", "version": {"version_data": [{"version_value": "< 4.6.7"}, {"version_value": ">= 5.0.0, < 5.0.3"}]}}]}, "vendor_name": "scylladb"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression)."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-908: Use of Uninitialized Resource"}]}]}, "references": {"reference_data": [{"name": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr", "refsource": "CONFIRM", "url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr"}, {"name": "https://github.com/scylladb/scylladb/issues/11476", "refsource": "MISC", "url": "https://github.com/scylladb/scylladb/issues/11476"}, {"name": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb", "refsource": "MISC", "url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb"}]}, "source": {"advisory": "GHSA-25pq-rrqm-6fmr", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:17:54.296Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/scylladb/scylladb/issues/11476"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T15:49:10.278634Z", "id": "CVE-2022-29240", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T17:10:05.343Z"}}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-29240", "datePublished": "2022-09-15T21:20:11.000Z", "dateReserved": "2022-04-13T00:00:00.000Z", "dateUpdated": "2025-04-23T17:10:05.343Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/scylladb/scylladb/issues/11476", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:17:54.296Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-29240", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-23T15:49:10.278634Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T15:49:12.791Z"}}], "cna": {"title": "Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla", "source": {"advisory": "GHSA-25pq-rrqm-6fmr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "scylladb", "product": "scylla", "versions": [{"status": "affected", "version": "< 4.6.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.3"}]}], "references": [{"url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/scylladb/scylladb/issues/11476", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-908", "description": "CWE-908: Use of Uninitialized Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-09-15T21:20:10.000Z"}, "x_legacyV4Record": {"impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, "source": {"advisory": "GHSA-25pq-rrqm-6fmr", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "< 4.6.7"}, {"version_value": ">= 5.0.0, < 5.0.3"}]}, "product_name": "scylla"}]}, "vendor_name": "scylladb"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr", "name": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr", "refsource": "CONFIRM"}, {"url": "https://github.com/scylladb/scylladb/issues/11476", "name": "https://github.com/scylladb/scylladb/issues/11476", "refsource": "MISC"}, {"url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb", "name": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-908: Use of Uninitialized Resource"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-29240", "STATE": "PUBLIC", "TITLE": "Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla", "ASSIGNER": "security-advisories@github.com"}}}}, "cveMetadata": {"cveId": "CVE-2022-29240", "state": "PUBLISHED", "dateUpdated": "2025-04-23T17:10:05.343Z", "dateReserved": "2022-04-13T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-09-15T21:20:11.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "scylla", "vendor": "scylladb", "versions": [{"status": "affected", "version": "< 4.6.7"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:scylladb:scylla:*:*:*:*:open_source:*:*:*", "matchCriteriaId": "62049391-A8C3-4963-B692-B9D0EBD24754", "versionEndExcluding": "4.6.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:scylladb:scylla:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "3D30E6EF-8EDA-467A-B467-0DD00916F5BE", "versionEndExcluding": "2020.1.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:scylladb:scylla:*:*:*:*:open_source:*:*:*", "matchCriteriaId": "3BD1B169-D009-459A-AA09-60835C7712EA", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:scylladb:scylla:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "25942345-FCBA-4788-B0CA-4E6C247C9862", "versionEndExcluding": "2021.1.12", "versionStartIncluding": "2021.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is greater than the real one, part of decompression buffer won't be overwritten, and will be left uninitialized. This can be exploited in several ways, depending on the privileges of the user. 1. The main exploit is that an attacker with access to CQL port, but no user account, can bypass authentication, but only if there are other legitimate clients making connections to the cluster, and they use LZ4. 2. Attacker that already has a user account on the cluster can read parts of uninitialized memory, which can contain things like passwords of other users or fragments of other queries / results, which leads to authorization bypass and sensitive information disclosure. The bug has been patched in the following versions: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Users unable to upgrade should make sure none of their drivers connect to cluster using LZ4 compression, and that Scylla CQL port is behind firewall. Additionally make sure no untrusted client can connect to Scylla, by setting up authentication and applying workarounds from previous point (firewall, no lz4 compression)."}, {"lang": "es", "value": "Scylla es una base de datos de big data en tiempo real que es compatible con la API de Apache Cassandra y Amazon DynamoDB. Cuando es descomprimida la trama CQL recibida del usuario, Scylla asume que la longitud sin comprimir proporcionada por el usuario es correcta. Si el usuario proporciona una longitud falsa, que es mayor que la real, parte del b\u00fafer de descompresi\u00f3n no ser\u00e1 sobrescrita, y ser\u00e1 dejada sin inicializar. Esto puede ser explotado de varias maneras, dependiendo de los privilegios del usuario. 1. La principal explotaci\u00f3n es que un atacante con acceso al puerto CQL, pero sin cuenta de usuario, puede omitir la autenticaci\u00f3n, pero s\u00f3lo si se presentan otros clientes leg\u00edtimos haciendo conexiones al cl\u00faster, y usan LZ4. 2. El atacante que ya presenta una cuenta de usuario en el cl\u00faster puede leer partes de la memoria no inicializada, que pueden contener cosas como contrase\u00f1as de otros usuarios o fragmentos de otras consultas/resultados, lo que conlleva a omitir la autorizaci\u00f3n y revelar informaci\u00f3n confidencial. El bug ha sido parcheado en las siguientes versiones: Scylla Enterprise: 2020.1.14, 2021.1.12, 2022.1.0. Scylla Open Source: 4.6.7, 5.0.3. Los usuarios que no puedan actualizar deben asegurarse de que ninguno de sus controladores sean conectados al cl\u00faster usando la compresi\u00f3n LZ4, y que el puerto CQL de Scylla est\u00e1 detr\u00e1s del firewall. Adem\u00e1s, aseg\u00farese de que ning\u00fan cliente no confiable pueda conectarse a Scylla, al configurar la autenticaci\u00f3n y aplicando las mitigaciones del punto anterior (firewall, sin compresi\u00f3n LZ4)"}], "id": "CVE-2022-29240", "lastModified": "2026-06-17T04:39:53.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-29240", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-23T15:49:10.278634Z", "version": "2.0.3"}}]}, "published": "2022-09-15T22:15:11.220", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/scylladb/scylladb/issues/11476"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/scylladb/scylla/security/advisories/GHSA-25pq-rrqm-6fmr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/scylladb/scylladb/commit/1c2eef384da439b0457b6d71c7e37d7268e471cb"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/scylladb/scylladb/issues/11476"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}