CVE-2022-3437

描述

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

如何修補 CVE-2022-3437

要修補 CVE-2022-3437,請將受影響套件升級到下列已修補版本。

• —升級至 7.7.1-r0 或更新版本
• —升級至 4.15.12-r0 或更新版本

CVE-2022-3437 正在被利用嗎?

低 — EPSS 為 3.7%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 7.7.1-r0
• >= 4.0.0, < 4.15.12-r0

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2022-3437