Vulnerability Details : CVE-2022-22728
A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2022-22728
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:libapreq2:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-22728
1.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 75 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-22728
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2022-22728
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by:
- nvd@nist.gov (Secondary)
- security@apache.org (Primary)
References for CVE-2022-22728
-
http://www.openwall.com/lists/oss-security/2023/01/03/2
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2023/01/02/2
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2022/08/25/3
oss-security - CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HZZKVHYYWACPWONPEFRNPIRE3HYLV4T/
[SECURITY] Fedora 36 Update: libapreq2-2.17-1.fc36 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BE5MEHGIQUEIISBCVHM43IN2NBDXBFOJ/
[SECURITY] Fedora 35 Update: libapreq2-2.17-1.fc35 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2022/08/26/4
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2022/08/25/4
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/202305-20
libapreq2: Buffer Overflow (GLSA 202305-20) — Gentoo security
-
http://www.openwall.com/lists/oss-security/2022/12/29/1
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2022/12/31/5
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/01/msg00009.html
[SECURITY] [DLA 3269-1] libapreq2 security updateMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2023/01/02/1
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2022/12/31/1
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
https://lists.apache.org/thread/2fsjoor96d47vtkpf76x4yo06nccvy1y
CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption-Apache Mail ArchivesMailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2022/12/30/4
oss-security - Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruptionMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PUUS3JL44UUSLJTSXE46HVKZIW7E7PE/
[SECURITY] Fedora 37 Update: libapreq2-2.17-1.fc37 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Jump to