huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-0691: npm-url-parse: authorization bypass through user-controlled key
Component: npm-url-parse
Severity: Important
CWE: CWE-639 (Authorization Bypass Through User-Controlled Key)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-02-21T00:00:00+00:00

An authorization bypass flaw was found in url-parse. This flaw allows a local unauthenticated attacker to add a backspace character (\b) while submitting a URL. This vulnerability can enable bypassing any hostname checks.


Affected upstream versions: unspecified < 1.5.9
Fixed upstream versions: 1.5.9
Upstream repository: https://github.com/unshiftio/url-parse
Upstream fix commit: 0e3fb542d60ddbf6933f22eb9b1e06e25eaa5b63
CVE-2022-0711: haproxy: Denial of service via set-cookie2 header
Component: haproxy
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-02-23T14:48:00+00:00

A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.

Statement: This issue was introduced in HAProxy 1.9 with the Native HTTP Representation (HTX). Red Hat Enterprise Linux 6, 7, 8 and Red Hat Software Collections are not affected by this flaw, as they ship older versions of `haproxy` which do not include support for HTX.

Affected upstream versions: 2.5.1
Fixed upstream versions: v2.6.0
Upstream repository: https://github.com/haproxy/haproxy
Upstream fix commit: bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8
CVE-2022-0718: python-oslo-utils: incorrect password masking in debug output
Component: python-oslo-utils
Severity: Moderate
CWE: CWE-532 (Insertion of Sensitive Information into Log File)
CVSS v3: 6 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L)
Public date: 2022-02-21T00:00:00+00:00

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.


Affected upstream versions: Affects all versions, Fixed in 4.10.1, 4.12.1.
Fixed upstream versions: 4.12.1
Upstream repository: https://opendev.org/openstack/oslo.utils
Upstream fix commit: 6e17ae1f7959c64dfd20a5f67edf422e702426aa
CVE-2022-0722: parse-url: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url
Component: parse-url
Severity: Moderate
CWE: CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-06-27T00:00:00+00:00

A flaw was found in the parse-url package. Affected versions of this package are vulnerable to information exposure due to an improper validation issue.


Affected upstream versions: unspecified < 7.0.0
Fixed upstream versions: 7.0.0
Upstream repository: https://github.com/ionicabizau/parse-url
Upstream fix commit: 21c72ab9412228eea753e2abc48f8962707b1fe3
CVE-2022-0778: openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
Component: openssl
Severity: Important
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-03-15T00:00:00+00:00

A flaw was found in OpenSSL. It is possible to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied certificate may be subject to a denial of service attack.

Statement: While Red Hat initially stated not to be directly affected by this flaw, after further investigation we found that the versions of OpenSSL as shipped in Red Hat Enterprise Linux 6, 7, and 8 are vulnerable to a denial of service attack through malicious Elliptic Curve parameters. During processing of the parameters OpenSSL will call BN_mod_sqrt() with invalid arguments, causing the process to enter an infinite loop. The invalid EC parameters can be provided to OpenSSL through X.509 certificates (used in TLS connections), through public and private keys, through certificate signing requests and other places where applications process Elliptic Curve parameters. The flaw has been rated as having a security impact of Important. A future update will address this issue in Red Hat Enterprise Linux 6, 7 and 8.

Affected upstream versions: Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1), Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m), Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)
Fixed upstream versions: 3.0-POST-CLANG-FORMAT-WEBKIT
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: a466912611aa6cbdf550cd10601390e587451246
CVE-2022-0839: liquibase: Improper Restriction of XML External Entity
Component: liquibase
Severity: Important
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2022-01-15T00:00:00+00:00

A flaw was found in Liquiibase's XMLChangeLogSAXParser() function. It uses SAXParser with no FEATURE_SECURE_PROCESSING set, which could possibly allow XML External Entity (XXE) attacks.

Statement: The impact to Satellite up to 6.11 is very low, as it does not use custom or external XSD in Candlepin's liquibase changelog files. Satellite 6.12 and later versions are not affected by this flaw.

Affected upstream versions: unspecified < 4.8.0
Fixed upstream versions: 4.8.0
Upstream repository: https://github.com/liquibase/liquibase
Upstream fix commit: 33d9d925082097fb1a3d2fc8e44423d964cd9381
CVE-2022-0847: kernel: improper initialization of the "flags" member of the new pipe_buffer
Component: kernel
Severity: Important
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-03-07T12:00:00+00:00

A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.

Statement: Red Hat Product Security is aware of this issue. Updates will be released as they become available.

Note that PIPE_BUF_FLAG_CAN_MERGE flag attack vector is not available in Red Hat Enterprise Linux 8 and thus the currently known exploits leveraging this flag do not work. The underlying issue (lack of proper pipe_buffer structure initialization) is still present though and other novel ways leading to successful exploitation cannot be fully ruled out.

Affected upstream versions: Linux Kernel 5.17 rc6
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/lib/iov_iter.c
Upstream fix commit: 9d2231c5d74e13b2a0546fee6737ee4446017903
CVE-2022-0850: kernel: information leak in copy_page_to_iter() in iov_iter.c
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2021-05-06T19:30:00+00:00

An information leak flaw was found via ext4_extent_header in fs/ext4/extents.c in the Linux kernel. This flaw could allow a local attacker to cause a denial of service.


Affected upstream versions: Fixed in kernel v5.14 rc1
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ce3aba43599f0b50adbebff133df8d08a3d5fffe
CVE-2022-0852: convert2rhel: Red Hat account password passed via command line by code
Component: convert2rhel
Severity: Important
CWE: CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Public date: 2022-04-26T16:00:00+00:00

There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.


Affected upstream versions: Fixed in v0.26.
Fixed upstream versions: v0.9-1713528412
Upstream repository: https://github.com/oamg/convert2rhel
Upstream fix commit: 8d72fb030ed31116fdb256b327d299337b000af4
CVE-2022-0854: kernel: swiotlb information leak with DMA_FROM_DEVICE
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-03-07T10:00:00+00:00

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.


Affected upstream versions: Linux kernel 5.17-rc8
Fixed upstream versions: v5.17
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c
Upstream fix commit: aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13
CVE-2022-0891: libtiff: heap buffer overflow in extractImageSection
Component: libtiff
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2022-02-22T00:00:00+00:00

A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact

Statement: The severity of this flaw was changed to Low because it is an out-of-bounds read of 1 byte and in the tiffcrop tool rather than in the library.

Affected upstream versions: >=3.9.0, <=4.3.0
Fixed upstream versions: v4.4.0
Upstream repository: https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff
Upstream fix commit: 232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c
CVE-2022-0908: tiff: Null source pointer passed as an argument to memcpy in TIFFFetchNormalTag() in tif_dirread.c
Component: tiff
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-03-11T00:00:00+00:00

A flaw was found in LibTIFF where a NULL source pointer passed as an argument to the memcpy() function within the TIFFFetchNormalTag() in tif_dirread.c. This flaw allows an attacker with a crafted TIFF file to cause a crash that leads to a denial of service.


Affected upstream versions: <=4.3.0
Fixed upstream versions: v4.4.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: a95b799f65064e4ba2e2dfc206808f86faf93e85
CVE-2022-0934: dnsmasq: Heap use after free in dhcp6_no_relay
Component: dnsmasq
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-03-28T00:00:00+00:00

A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.

Statement: The severity of this flaw was set to Moderate because this is a 1-byte out-of-bounds write/use-after-free issue where the attacker does not control the data written (it is predefined in a header file). The highest impact is only to availability.

Affected upstream versions: Not-Known
Fixed upstream versions: v2.87
Upstream repository: https://thekelleys.org.uk/gitweb/dnsmasq.git
Upstream fix commit: 03345ecefeb0d82e3c3a4c28f27c3554f0611b39
CVE-2022-0943: vim: Heap-based Buffer Overflow occurs in vim
Component: vim
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-03-14T00:00:00+00:00

A heap buffer overflow flaw was found in vim's suggest_try_change() function of the spellsuggest.c file. This flaw allows an attacker to trick a user into opening a crafted file, triggering a heap-overflow and causing an application to crash, which leads to a denial of service.

Statement: Red Hat Enterprise Linux - 6, 7, 8 are not affected, because vulnerable code is not present in binary RPMs of Vim shipped with RHEL.

Red Hat Enterprise Virtualization 4 consumes RHEL-8 vim, and as RHEL-8 is not affected, Hence, RHEV is also not affected.

Red Hat Product Security has rated this issue as having a Moderate security impact. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Affected upstream versions: unspecified < 8.2.4563
Fixed upstream versions: 8.2.4563
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 5c68617d395f9d7b824f68475b24ce3e38d653a3
CVE-2022-1055: kernel: use-after-free in tc_new_tfilter() in net/sched/cls_api.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-01-31T00:00:00+00:00

A use-after-free vulnerability was found in the tc_new_tfilter function in net/sched/cls_api.c in the Linux kernel. The availability of local, unprivileged user namespaces allows privilege escalation.

Statement: The vulnerability in the Linux kernel is shipped in Red Hat Enterprise Linux 8.

Affected upstream versions: 5.1.0 < 5.4.177, 5.5.0 < 5.10.97, 5.11.0 < 5.15.20, 5.16.0 < 5.16.6
Fixed upstream versions: 5.10.97, 5.15.20, 5.16.6, 5.17.0, 5.4.177
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5
CVE-2022-1117: fapolicyd: fapolicyd wrongly prepares ld.so path
Component: fapolicyd
Severity: Moderate
CWE: CWE-552 (Files or Directories Accessible to External Parties)
CVSS v3: 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-05-02T00:00:00+00:00

A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.


Affected upstream versions: Fixed in v1.1.2
Fixed upstream versions: v1.1.2
Upstream repository: https://github.com/linux-application-whitelisting/fapolicyd
Upstream fix commit: 38a942613f93824c53164730b2b7a2f75b8cd263
CVE-2022-1154: vim: use after free in utf_ptr2char
Component: vim
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2022-04-06T00:00:00+00:00

A heap use-after-free vulnerability was found in Vim's utf_ptr2char() function of the src/mbyte.c file. This flaw occurs because vim is using a buffer line after it has been freed in the old regexp engine. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering a heap use-after-free that causes an application to crash, possibly executing code and corrupting memory.

Statement: All versions of Vim shipped with Red Hat Enterprise Linux are affected, because of the presence of vulnerable code in our code-base.

Red Hat Enterprise Virtualization 4 consumes RHEL-8 vim, and as RHEL-8 is affected, Hence, RHEV is also affected.

Red Hat Product Security has rated this issue as having a Low security impact, because the "victim" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.

Since Red Hat Enterprise Linux 6, 7 are Out-of-Support-Scope for Low/Moderate flaws, the issue is not currently planned to be addressed in future updates for RHEL-6,7. Only Important and Critical severity flaws will be addressed at this time.

For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/ and Red Hat Enterprise Linux Life Cycle & Updates Policy: https://access.redhat.com/support/policy/updates/errata/.

Affected upstream versions: unspecified < 8.2.4646
Fixed upstream versions: 8.2.4646
Upstream repository: https://github.com/vim/vim
Upstream fix commit: b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5
CVE-2022-1215: libinput: format string vulnerability may lead to privilege escalation
Component: libinput
Severity: Moderate
CWE: CWE-134 (Use of Externally-Controlled Format String)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-04-20T00:00:00+00:00

A format string vulnerability was found in libinput

Statement: This flaw is out of support scope for versions of libinput shipped with Red Hat Enterprise Linux 7. The severity was set to Moderate because a potential attacker would need to be physically within bluetooth range of the victim machine, in addition to using an already-paired device.

Affected upstream versions: libinput 1.10 and above
Fixed upstream versions: 1.19.4
Upstream repository: https://gitlab.freedesktop.org/libinput/libinput
Upstream fix commit: 04f22107e1a2ead05401d9169fa4306e8c7eefad
CVE-2022-1263: kernel: KVM: NULL pointer dereference in kvm_dirty_ring_push in virt/kvm/dirty_ring.c
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-07T00:00:00+00:00

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.

Statement: Red Hat Enterprise Linux 6 and 7 did not provide support for KVM dirty ring and therefore are not affected by this issue.

Affected upstream versions: Fixed in kernel v5.18-rc3
Fixed upstream versions: v5.18
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 5593473a1e6c743764b08e3b6071cb43b5cfa6c4
CVE-2022-1271: gzip: arbitrary-file-write vulnerability
Component: gzip
Severity: Important
CWE: CWE-73 (External Control of File Name or Path)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-04-07T00:00:00+00:00

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Statement: This bug was introduced in gzip-1.3.10 and is relatively hard to exploit.

Red Hat Enterprise Linux 6 was affected but Out of Support Cycle because gzip was not listed in Red Hat Enterprise Linux 6 ELS Inclusion List.
https://access.redhat.com/articles/4997301

Affected upstream versions: Fixed in gzip 1.12
Fixed upstream versions: v5.4.0
Upstream repository: https://git.tukaani.org/xz.git
Upstream fix commit: 69d1b3fc29677af8ade8dc15dba83f0589cb63d6
CVE-2022-1292: openssl: c_rehash script allows command injection
Component: openssl
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-05-03T00:00:00+00:00

A flaw was found in OpenSSL. The `c_rehash` script does not properly sanitize shell meta-characters to prevent command injection. Some operating systems distribute this script in a manner where it is automatically executed. This flaw allows an attacker to execute arbitrary commands with the privileges of the script on these operating systems.

Statement: Red Hat Enterprise Linux uses a system-wide store of trusted certificates bundled in a single file and updated via `update-ca-trust`. The `c_rehash` script is not included in the default installation on any supported RHEL version, and is never executed automatically. For these reasons, this flaw has been rated as having a security impact of Moderate.

Red Hat Enterprise Linux 7 provides a vulnerable version of the `c_rehash` script in the `openssl-perl` package, available only through the unsupported Optional repository.  As the Optional repository is not supported and Red Hat Enterprise Linux 7 is in Maintenance Support 2 Phase, this issue is not planned to be addressed there.

Red Hat Satellite ships an affected version of the `c_rehash` script embedded in `puppet-agent` package, however, the product is not vulnerable since it does not execute scripts with untrusted data. Moreover, the scriplet is owned by root user and is supposed to be accessed only by administrators.

Red Hat updates the OpenSSL compatibility packages (compat-openssl) to only address Important or Critical security issues with backported security patches.

Affected upstream versions: Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2), Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n), Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)
Fixed upstream versions: 3.0-POST-CLANG-FORMAT-WEBKIT
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
CVE-2022-1319: undertow: Double AJP response for 400 from EAP 7 results in CPING failures
Component: undertow
Severity: Moderate
CWE: CWE-252 (Unchecked Return Value)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-11T00:00:00+00:00

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.


Affected upstream versions: Fixed in 2.3.0.Final, 2.2.18.Final, 2.2.17.SP3, 2.2.17.SP4, 2.3.0.Alpha2
Fixed upstream versions: 2.2.18.Final
Upstream repository: https://github.com/undertow-io/undertow
Upstream fix commit: 1443a1a2bbb8e32e56788109d8285db250d55c8b
CVE-2022-1328: mutt: buffer overflow in uudecoder function
Component: mutt
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Public date: 2022-04-14T00:00:00+00:00

A flaw was found in mutt. When reading unencoded messages, mutt uses the line length from the untrusted input without any validation. This flaw allows an attacker to craft a malicious message, which leads to an out-of-bounds read, causing data leaks that include fragments of other unrelated messages.


Affected upstream versions: >=0.94.13, <2.2.3
Fixed upstream versions: mutt-2-2-3-rel
Upstream repository: https://gitlab.com/muttmua/mutt
Upstream fix commit: e5ed080c00e59701ca62ef9b2a6d2612ebf765a5