CVE-2022-37797

2022-09-1215:15:08

CWE-476

mitre

web.nvd.nist.gov

lighttpd

cve-2022-37797

mod_wstunnel

denial of service

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

57.7%

JSON

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Affected configurations

Nvd

Node

lighttpdlighttpdMatch1.4.65

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
lighttpdlighttpd1.4.65cpe:2.3:a:lighttpd:lighttpd:1.4.65:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*