Lucene search

K
mageiaGentoo FoundationMGASA-2022-0369
HistoryOct 13, 2022 - 11:05 p.m.

Updated lighttpd packages fix security vulnerability

2022-10-1323:05:19
Gentoo Foundation
advisories.mageia.org
24
lighttpd 1.4.65
mod_wstunnel
null pointer dereference
denial of service
resource leak
mod_fastcgi
mod_scgi
cve-2022-37797
cve-2022-41556
unix

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

62.2%

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. (CVE-2022-37797) A resource leak in mod_fastcgi and mod_scgi could lead to a denial of service after a large number of bad HTTP requests. (CVE-2022-41556)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchlighttpd< 1.4.59-1.2lighttpd-1.4.59-1.2.mga8

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

62.2%