CVE-2022-2469 — Out-of-bounds Read in Sasl

CWE-125 — Out-of-bounds Read6 documents6 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 79.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GNU SaslDebian GsaslDebian Linux
Timeline
PublishedJul 19
Latest updateJun 15

Description

GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages3 packages

▶NVDgnu/gnu_sasl< 2.0.1
▶debiandebian/gsasl< gsasl 2.0.1-1 (bookworm)
▶CVEListV5gnu/gnu_sasl>=0.0.0, <2.0.1

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-r9xr-xfwx-6crw: GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client↗2022-07-20
▶
OSV
CVE-2022-2469: GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GSS-API client↗2022-07-19
▶

📋Vendor Advisories

3
Ubuntu
GNU SASL vulnerability↗2023-06-15
▶
Red Hat
libgsasl: Out of bounds read causes DoS↗2022-07-18
▶
Debian
CVE-2022-2469: gsasl - GNU SASL libgsasl server-side read-out-of-bounds with malicious authenticated GS...↗2022
▶