Lucene search

[email protected]CVE-2022-20785

HistoryMay 04, 2022 - 5:15 p.m.

CVE-2022-20785

2022-05-0417:15:08

CWE-401

[email protected]

web.nvd.nist.gov

136

clamav

html

vulnerability

remote attack

denial of service

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.2 High

AI Score

Confidence

High

0.017 Low

EPSS

Percentile

87.7%

JSON

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Affected configurations

NVD

Node

clamavclamavRange<0.103.5

clamavclamavRange≤0.103.5lts

clamavclamavRange0.104.0–0.104.2

Node

ciscosecure_endpointRange<1.16.3macos

ciscosecure_endpointRange<1.17.2linux

ciscosecure_endpointRange<7.5.5windows

ciscosecure_endpointRange1.18.0–1.18.2linux

ciscosecure_endpointRange1.18.0–1.18.2macos

Node

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

Node

debiandebian_linuxMatch9.0

CPENameOperatorVersion
clamav:clamavclamavlt0.103.5
clamav:clamavclamavlt0.104.2

CPE	Name	Operator	Version
clamav:clamav	clamav	lt	0.103.5
clamav:clamav	clamav	lt	0.104.2

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco AMP for Endpoints ",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]