CVE-2022-32292

2022-08-0314:15:08

Debian Security Bug Tracker

security-tracker.debian.org

cve-2022-32292

connman

remote attackers

http requests

gweb component

heap-based buffer overflow

code execution

unix

security vulnerability

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.021 Low

EPSS

Percentile

89.0%

JSON

In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code.

OSVersionArchitecturePackageVersionFilename
Debian12allconnman< 1.41-2connman_1.41-2_all.deb
Debian11allconnman< 1.36-2.2+deb11u1connman_1.36-2.2+deb11u1_all.deb
Debian999allconnman< 1.41-2connman_1.41-2_all.deb
Debian13allconnman< 1.41-2connman_1.41-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	connman	< 1.41-2	connman_1.41-2_all.deb
Debian	11	all	connman	< 1.36-2.2+deb11u1	connman_1.36-2.2+deb11u1_all.deb
Debian	999	all	connman	< 1.41-2	connman_1.41-2_all.deb
Debian	13	all	connman	< 1.41-2	connman_1.41-2_all.deb