huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2022-41859: freeradius: Information leakage in EAP-PWD
Component: freeradius
Severity: Moderate
CWE: CWE-208 (Observable Timing Discrepancy)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-04-22T00:00:00+00:00

In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.


Affected upstream versions: unknown
Fixed upstream versions: release_3_0_26
Upstream repository: https://github.com/FreeRADIUS/freeradius-server
Upstream fix commit: 9e5e8f2f
CVE-2022-41860: freeradius: Crash on unknown option in EAP-SIM
Component: freeradius
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-22T00:00:00+00:00

In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.


Affected upstream versions: All versions from 0.9.3 to 3.0.25
Fixed upstream versions: release_3_0_26
Upstream repository: https://github.com/FreeRADIUS/freeradius-server
Upstream fix commit: f1cdbb33ec61c4a64a
CVE-2022-41861: freeradius: Crash on invalid abinary data
Component: freeradius
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-04-22T00:00:00+00:00

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.


Affected upstream versions: All versions from 0.0.1 to 3.0.25
Fixed upstream versions: release_3_0_26
Upstream repository: https://github.com/FreeRADIUS/freeradius-server
Upstream fix commit: 0ec2b39d260e
CVE-2022-41877: freerdp: missing input length validation in `drive` channel
Component: freerdp
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L)
Public date: 2022-11-16T00:00:00+00:00

An out-of-bounds read vulnerability was discovered in FreeRDP due to improper input length validation in the drive channel. A malicious server can trick a FreeRDP based client to read out-of-bound data and send it back to the server.


Affected upstream versions: < 2.9.0
Fixed upstream versions: 2.9.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 6655841cf2a00b764f855040aecb8803cfc5eaba
CVE-2022-41903: git: Heap overflow in `git archive`, `git log --format` leading to RCE
Component: git
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-17T00:00:00+00:00

A flaw was found in Git, a distributed revision control system. This issue occurs due to an integer overflow in `pretty.c::format_and_pad_commit()`, where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through the git archive via the export-subst mechanism, which expands format specifiers inside files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may allow arbitrary code execution.


Affected upstream versions: < 2.30.7, >= 2.31.0, < 2.31.6, >= 2.32.0, < 2.32.5, >= 2.33.0, < 2.33.6, >= 2.34.0, < 2.34.6, >= 2.35.0, < 2.35.6, >= 2.36.0, < 2.36.4, >= 2.37.0, < 2.37.5, >= 2.38.0, < 2.38.3, = 2.39.0
Fixed upstream versions: v2.40.0
Upstream repository: https://github.com/git/git
Upstream fix commit: 508386c6c5857b4faa2c3e491f422c98cc69ae76
CVE-2022-41912: crewjam/saml: Authentication bypass when processing SAML responses containing multiple Assertion elements
Component: crewjam/saml
Severity: Critical
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2022-11-28T00:00:00+00:00

An authentication bypass flaw was discovered in the crewjam/saml go package. A remote unauthenticated attacker could trigger it by sending a SAML request. This would allow an escalation of privileges and then enable  compromising system integrity.

Statement: Whilst the Red Hat Advanced Cluster Management for Kubernetes (RHACM) acm-grafana container include the vulnerable underscore library, the access to it is protected by OpenShift OAuth. Therefore the impact by this flaw is reduced from Critical to Important.

The OCP grafana-container includes the vulnerable underscore library, the access to it is protected by OpenShift OAuth. Therefore the impact by this flaw is reduced from Critical to Important.

While Red Hat Ceph Storage 4's grafana-container includes the affected code, this is used for logging and limits access to the rest of the Ceph cluster. Thus the impact has been reduced from critical to important. Red Hat Ceph Storage 3 and 4 do not use crewjam/saml in their version of grafana.

Affected upstream versions: < 0.4.9
Fixed upstream versions: v0.4.9
Upstream repository: https://github.com/crewjam/saml
Upstream fix commit: aee3fb1edeeaf1088fcb458727e0fd863d277f8b
CVE-2022-41940: engine.io: Specially crafted HTTP request can trigger an uncaught exception
Component: engine.io
Severity: Moderate
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-11-22T00:00:00+00:00

A flaw was found in engine.io. The Socket.IO Engine.IO is vulnerable to a denial of service caused by an uncaught exception flaw. By sending a specially-crafted HTTP request, a remote, authenticated attacker can cause the Node.js process to crash, resulting in a denial of service.


Affected upstream versions: < 3.6.1, >= 4.0.0, < 6.2.1
Fixed upstream versions: 6.2.1
Upstream repository: https://github.com/socketio/engine.io
Upstream fix commit: 425e833ab13373edf1dd5a0706f07100db14e3c6
CVE-2022-41946: postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions
Component: postgresql-jdbc
Severity: Moderate
CWE: CWE-379 (Creation of Temporary File in Directory with Insecure Permissions)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-11-23T00:00:00+00:00

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setText(int, InputStream) and PreparedStatemet.setBytea(int, InputStream). This could allow a user to create an unexpected file available to all users, which could end in unexpected behavior.

Statement: Red Hat Satellite ships a PostgreSQL JDBC Driver for Hibernate ORM framework, which is embeds into Candlepin. Although Candlepin itself doesn't make direct use of the PreparedStatement methods from the PostgreSQL JDBC Driver, Hibernate ORM does utilize these methods, potentially making framework affected. Satellite server operating in an environment with untrusted users while the driver is running are vulnerable to the flaw, however, deployments without untrusted users are considered safe. A future Satellite update should address this issue.

Affected upstream versions: >= 42.2.0, < 42.2.27, > 42.3.0, < 42.3.8, >= 42.4.0, < 42.4.3, >= 42.5.0, < 42.5.1
Fixed upstream versions: REL42.5.1
Upstream repository: https://github.com/pgjdbc/pgjdbc
Upstream fix commit: 9008dc9aade6dbfe4efafcd6872ebc55f4699cf5
CVE-2022-42003: jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS
Component: jackson-databind
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-02T00:00:00+00:00

A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.


Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.14.0
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: d78d00ee7b5245b93103fef3187f70543d67ca33
CVE-2022-42004: jackson-databind: use of deeply nested arrays
Component: jackson-databind
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-02T00:00:00+00:00

A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.


Affected upstream versions: n/a
Fixed upstream versions: jackson-databind-2.13.4
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 063183589218fec19a9293ed2f17ec53ea80ba88
CVE-2022-4203: openssl: read buffer overflow in X.509 certificate verification
Component: openssl
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.

Statement: Red Hat Enterprise Linux 6, 7, and 8 ships OpenSSL 1.1.1 and 1.0.2 which do not contain the incorrect code, so those are not affected by this CVE. Similarly, the versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are not affected by this issue.

Affected upstream versions: 3.0.0 < 3.0.8
Fixed upstream versions: 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: c927a3492698c254637da836762f9b1f86cffabc
CVE-2022-4254: sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
Component: sssd
Severity: Important
CWE: CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-01-24T00:00:00+00:00

A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to authenticate to the KDC using an X.509 certificate and the corresponding private key, rather than a passphrase or keytab. FreeIPA uses mapping rules to map a certificate presented during a PKINIT authentication request to the corresponding principal. The mapping filter is vulnerable to LDAP filter injection. The search result can be influenced by values in the certificate, which may be attacker controlled. In the most extreme case, an attacker could gain control of the admin account, leading to full domain takeover.

Statement: The issue was introduced in SSSD 1.15.3 (when libsss_certmap was introduced) and resolved in SSSD 2.3.1. It only affects versions of SSSD shipped with RHEL-8.2.0.z and lower streams. Later versions are not affected. 

FreeIPA is not vulnerable in its default configuration.

Affected upstream versions: Affects SSSD 1.15.3, Fixed in SSSD 2.3.1
Fixed upstream versions: sssd-2_3_1
Upstream repository: https://github.com/SSSD/sssd
Upstream fix commit: a2b9a84460429181f2a4fa7e2bb5ab49fd561274
CVE-2022-42703: kernel: use-after-free related to leaf anon_vma double reuse
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-09T00:00:00+00:00

A memory leak flaw with use-after-free capability was found in the Linux kernel. The VMA mm/rmap.c functionality in the is_mergeable_anon_vma() function continuously forks, using memory operations to trigger an incorrect reuse of leaf anon_vma. This issue allows a local attacker to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 2555283eb40df89945557273121e9393ef9b542b
CVE-2022-42720: kernel: use-after-free in bss_ref_get in net/wireless/scan.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2022-10-13T10:00:00+00:00

A use-after-free flaw was found in bss_ref_get in the net/wireless/scan.c in the Linux kernel. This issue can lead to a denial of service or arbitrary code execution.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git
Upstream fix commit: 0b7808818cb9df6680f98996b8e9a439fa7bcc2f
CVE-2022-42721: kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-13T10:00:00+00:00

A list corruption flaw was found in cfg80211_add_nontrans_list in the net/wireless/scan.c function in the Linux kernel. This flaw could lead to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git
Upstream fix commit: bcca852027e5878aec911a347407ecc88d6fff7f
CVE-2022-42722: kernel: Denial of service in beacon protection for P2P-device
Component: kernel
Severity: Moderate
CWE: CWE-705 (Incorrect Control Flow Scoping)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-13T10:00:00+00:00

A flaw was found in P2P-Device in wifi in ieee80211_rx_h_decrypt in net/mac80211/rx.c in the Linux kernel, leading to a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git
Upstream fix commit: b2d03cabe2b2e150ff5a381731ea0355459be09f
CVE-2022-4285: binutils: NULL pointer dereference in _bfd_elf_get_symbol_version_string leads to segfault
Component: binutils
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2022-10-19T00:00:00+00:00

An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of service. This issue is the result of an incomplete fix for CVE-2020-16599.


Affected upstream versions: binutils 2.39-7
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: 5c831a3c7f3ca98d6aba1200353311e1a1f84c70
CVE-2022-42895: kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-11-03T00:00:00+00:00

An information leak vulnerability was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_parse_conf_req function. An attacker with physical access within the range of standard Bluetooth transmission could use this flaw to leak kernel pointers via Bluetooth if within proximity of the victim.

Statement: Red Hat Enterprise Linux 6 is not affected by this flaw as it did not include support for parsing Extended Flow Specification option in L2CAP Config Request (upstream commit 42dceae2).

Affected upstream versions: 3.0.0 <= b1a2cd50c0357f243b7435a732b4e62ba3157a2e
Fixed upstream versions: v6.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b1a2cd50c0357f243b7435a732b4e62ba3157a2e
CVE-2022-42896: kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2022-11-03T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2cap_connect and l2cap_le_connect_req functions. An attacker with physical access within the range of standard Bluetooth transmission could execute code leaking kernel memory via Bluetooth if within proximity of the victim.


Affected upstream versions: 3.0.0 <= 711f8c3fb3db61897080468586b970c87c61d9e4
Fixed upstream versions: v6.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 711f8c3fb3db61897080468586b970c87c61d9e4
CVE-2022-42898: krb5: integer overflow vulnerabilities in PAC parsing
Component: krb5
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-11-15T00:00:00+00:00

A vulnerability was found in MIT krb5. This flaw allows an authenticated attacker to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service to crash.

Statement: Samba in RHEL does not implement the AD DC role and is not built against Heimdal, thus Samba is not affected by this CVE.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.21-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
CVE-2022-4361: RHSSO: XSS due to lax URI scheme validation
Component: RHSSO
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2023-06-27T00:00:00+00:00

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.


Affected upstream versions: <= 1.3.0.Final
Fixed upstream versions: 21.1.2
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: a1cfe6e24e5b34792699a00b8b4a8016a5929e3a
CVE-2022-43750: kernel: memory corruption in usbmon driver
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-09-22T00:00:00+00:00

An out-of-bounds memory write flaw in the Linux kernel’s USB Monitor component was found in how a user with access to the /dev/usbmon can trigger it by an incorrect write to the memory of the usbmon. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a659daf63d16aa883be42f3f34ff84235c302198
CVE-2022-4379: kernel: use-after-free in __nfs42_ssc_open() in fs/nfs/nfs4file.c leading to remote Denial of Service attack
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-12-15T06:30:00+00:00

A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial of service.


Affected upstream versions: Linux kernel through v6.1-rc8
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 75333d48f92256a0dec91dbf07835e804fc411c0
CVE-2022-43945: kernel: nfsd buffer overflow by RPC message over TCP with garbage data
Component: kernel
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2022-10-03T09:00:00+00:00

A buffer overflow flaw was found in the Linux kernel nfsd (network file system) subsystem. The way a user sends RPC over TCP with excess data added at the end of the message could allow a remote user to starve the resources, causing a denial of service.

Statement: Affected versions of the Red Hat Enterprise Linux are 8.7 and higher, because starting from the 8.7 the affected source code introduced with the errata RHSA-2022:7683.

Affected upstream versions: < 6.0.2
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f90497a16e434c2211c66e3de8e77b17868382b8
CVE-2022-4415: systemd: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel setting
Component: systemd
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-12-21T00:00:00+00:00

A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.


Affected upstream versions: systemd >= 247
Fixed upstream versions: v253
Upstream repository: https://github.com/systemd/systemd
Upstream fix commit: b7641425659243c09473cd8fb3aef2c0d4a3eb9c
CVE-2022-4450: openssl: double free after calling PEM_read_bio_ex
Component: openssl
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-07T00:00:00+00:00

A double-free vulnerability was found in OpenSSL's PEM_read_bio_ex function. The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (for example, "CERTIFICATE"), any header data, and the payload data. If the function succeeds, then the "name_out," "header," and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. Constructing a PEM file that results in 0 bytes of payload data is possible. In this case, PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a freed buffer. A double-free will occur if the caller also frees this buffer. This will most likely lead to a crash. This could be exploited by an attacker who can supply malicious PEM files for parsing to achieve a denial of service attack.

Statement: A double-free vulnerability was found in the OpenSSL library in the PEM_read_bio_ex() function and its wrappers. The flaw is triggered when the library parses a specially crafted PEM file constructed to have zero bytes of payload data. This edge case causes the function to return a failure code but also populate a header argument with a pointer to memory that has already been freed, leading to a double-free condition if the calling application also attempts to free it, resulting in a crash and a denial of service. The flaw is rated as moderate because it results in a crash but does not allow code execution, memory corruption beyond the crash, or data leakage.

The versions of `shim` as shipped with Red Hat Enterprise Linux 8 and 9 are shipping OpenSSL 1.1.1 and 1.0.2, which do not contain the incorrect code, so those are not affected by this CVE.

Affected upstream versions: 3.0.0 < 3.0.8, 1.1.1 < 1.1.1t
Fixed upstream versions: 1.1.1t, 3.0.8
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 63bcf189be73a9cc1264059bed6f57974be74a83