CVE-2021-22191
published 2021-03-15CVE-2021-22191: Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
PriorityP354high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
3.64%
88.3th percentile
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | wireshark | < wireshark 3.4.4-1 (bookworm) | wireshark 3.4.4-1 (bookworm) |
| oracle | zfs_storage_appliance | — | — |
| the_wireshark_foundation | wireshark | — | — |
| the_wireshark_foundation | wireshark | — | — |
| wireshark | wireshark | >= 0 < 3.4.4-1 | 3.4.4-1 |
| wireshark | wireshark | >= 0 < 3.4.4-1 | 3.4.4-1 |
| wireshark | wireshark | >= 0 < 3.4.4-1 | 3.4.4-1 |
| wireshark | wireshark | >= 0 < 3.4.4-1 | 3.4.4-1 |
| wireshark | wireshark | 3.2.0 – 3.2.11 | — |
| wireshark | wireshark | 3.4.0 – 3.4.3 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
wireshark: improper URL handling may lead to remote code execution
vendor_redhat·2021-03-11·CVSS 6.3
CVE-2021-22191 [MEDIUM] CWE-20 wireshark: improper URL handling may lead to remote code execution
wireshark: improper URL handling may lead to remote code execution
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
There's a flaw in Wireshark. An attacker who sends malicious links with schemes other than http/https over the wire or via a pcapng file, and who is able to get a victim user of Wireshark's user interface to click these links, could perform actions such as mounting volumes, or in some cases launching undesired programs.
Statement: Versions of Wireshark shipped with Red Hat Enterprise Linux 6, 7, and 8 are not affected by this flaw.
Mitigation: This flaw can be entirely mitigated by ensuring that Wireshark users do not click arbitrary links found in wire captures and fr
Debian
CVE-2021-22191: wireshark - Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allo...
vendor_debian·2021·CVSS 6.3
CVE-2021-22191 [MEDIUM] CVE-2021-22191: wireshark - Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allo...
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
Scope: local
bookworm: resolved (fixed in 3.4.4-1)
bullseye: resolved (fixed in 3.4.4-1)
forky: resolved (fixed in 3.4.4-1)
sid: resolved (fixed in 3.4.4-1)
trixie: resolved (fixed in 3.4.4-1)
GHSA
GHSA-w6w5-wrcg-5jrx: Improper URL handling in Wireshark 3
ghsa_unreviewed·2022-05-24
CVE-2021-22191 [HIGH] CWE-74 GHSA-w6w5-wrcg-5jrx: Improper URL handling in Wireshark 3
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
OSV
CVE-2021-22191: Improper URL handling in Wireshark 3
osv·2021-03-15·CVSS 8.8
CVE-2021-22191 [HIGH] CVE-2021-22191: Improper URL handling in Wireshark 3
Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22191.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/17232https://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlhttps://security.gentoo.org/glsa/202107-21https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.wireshark.org/security/wnpa-sec-2021-03.htmlhttps://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22191.jsonhttps://gitlab.com/wireshark/wireshark/-/issues/17232https://lists.debian.org/debian-lts-announce/2022/03/msg00041.htmlhttps://security.gentoo.org/glsa/202107-21https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.wireshark.org/security/wnpa-sec-2021-03.html
2021-03-15
Published