CVE-2022-32293

2022-08-0314:15:08

Debian Security Bug Tracker

security-tracker.debian.org

connman

wispr

http

use-after-free

vulnerability

code execution

unix

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.4%

JSON

In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes or code execution.

OSVersionArchitecturePackageVersionFilename
Debian12allconnman< 1.41-2connman_1.41-2_all.deb
Debian11allconnman< 1.36-2.2+deb11u1connman_1.36-2.2+deb11u1_all.deb
Debian999allconnman< 1.41-2connman_1.41-2_all.deb
Debian13allconnman< 1.41-2connman_1.41-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	connman	< 1.41-2	connman_1.41-2_all.deb
Debian	11	all	connman	< 1.36-2.2+deb11u1	connman_1.36-2.2+deb11u1_all.deb
Debian	999	all	connman	< 1.41-2	connman_1.41-2_all.deb
Debian	13	all	connman	< 1.41-2	connman_1.41-2_all.deb