CVE-2022-28652

2022-05-1700:00:00

ubuntu.com

vulnerability

parsing

config file

unix

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

9.0%

JSON

~/.config/apport/settings parsing is vulnerable to “billion laughs” attack

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchapport< 2.20.9-0ubuntu7.28UNKNOWN
ubuntu20.04noarchapport< 2.20.11-0ubuntu27.24UNKNOWN
ubuntu21.10noarchapport< 2.20.11-0ubuntu71.2UNKNOWN
ubuntu22.04noarchapport< 2.20.11-0ubuntu82.1UNKNOWN
ubuntu22.10noarchapport< 2.21.0-0ubuntu1UNKNOWN
ubuntu23.04noarchapport< 2.21.0-0ubuntu1UNKNOWN
ubuntu23.10noarchapport< 2.21.0-0ubuntu1UNKNOWN
ubuntu24.04noarchapport< 2.21.0-0ubuntu1UNKNOWN
ubuntu14.04noarchapport< anyUNKNOWN
ubuntu16.04noarchapport< 2.20.1-0ubuntu2.30+esm4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	apport	< 2.20.9-0ubuntu7.28	UNKNOWN
ubuntu	20.04	noarch	apport	< 2.20.11-0ubuntu27.24	UNKNOWN
ubuntu	21.10	noarch	apport	< 2.20.11-0ubuntu71.2	UNKNOWN
ubuntu	22.04	noarch	apport	< 2.20.11-0ubuntu82.1	UNKNOWN
ubuntu	22.10	noarch	apport	< 2.21.0-0ubuntu1	UNKNOWN
ubuntu	23.04	noarch	apport	< 2.21.0-0ubuntu1	UNKNOWN
ubuntu	23.10	noarch	apport	< 2.21.0-0ubuntu1	UNKNOWN
ubuntu	24.04	noarch	apport	< 2.21.0-0ubuntu1	UNKNOWN
ubuntu	14.04	noarch	apport	< any	UNKNOWN
ubuntu	16.04	noarch	apport	< 2.20.1-0ubuntu2.30+esm4	UNKNOWN