CVE-2022-23219

Published Jan 14, 2022

Last updated 2 years ago

Overview

Description: The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
Source: cve@mitre.org
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-120

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED46EB04-73DF-41D7-9E54-A50570DF766B",
            "versionEndIncluding": "2.34"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6EDB6772-7FDB-45FF-8D72-952902A7EE56"
          },
          {
            "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "04E6C8E9-2024-496C-9BFD-4548A5B44E2E"
          },
          {
            "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A264E0DE-209D-49B1-8B26-51AB8BBC97F1"
          },
          {
            "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EBB5FF32-7362-4A1E-AD24-EF6B8770FCAD"
          },
          {
            "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8B40FAF9-0A6B-41C4-8CAD-D3D1DD982C2C"
          },
          {
            "criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "74810125-09E6-4F27-B541-AFB61112AC56"
          },
          {
            "criteria": "cpe:2.3:a:oracle:enterprise_operations_monitor:4.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F5453265-3BE1-4AF0-BE50-13C2EF67F49B"
          },
          {
            "criteria": "cpe:2.3:a:oracle:enterprise_operations_monitor:4.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "93E0B297-A319-4961-976C-7DDA5A0B9353"
          },
          {
            "criteria": "cpe:2.3:a:oracle:enterprise_operations_monitor:5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AEFDF7DD-4D5D-410B-840F-99A8D7DEE4A6"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References