Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2022-1473

Опубликовано: 03 мая 2022
Источник: nvd
CVSS3: 7.5
CVSS2: 5
EPSS Низкий

Описание

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Версия от 3.0.0 (включая) до 3.0.3 (исключая)
Конфигурация 2

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
Конфигурация 3

Одновременно

cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*
Конфигурация 4

Одновременно

cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
Конфигурация 5

Одновременно

cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
Конфигурация 6

Одновременно

cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
Конфигурация 7

Одновременно

cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*
Конфигурация 8

Одновременно

cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*
Конфигурация 9

Одновременно

cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*
Конфигурация 10

Одновременно

cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
Конфигурация 11

Одновременно

cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*
Конфигурация 12

Одновременно

cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*
Конфигурация 13

Одновременно

cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*
Конфигурация 14

Одновременно

cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*
Конфигурация 15

Одновременно

cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*
Конфигурация 16

Одновременно

cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*
Конфигурация 17

Одновременно

cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*
Конфигурация 18

Одновременно

cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:*
Конфигурация 19

Одновременно

cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:*

EPSS

Процентиль: 47%
0.00238
Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-459
CWE-459

Связанные уязвимости

ubuntu логотип

CVE-2022-1473

CVSS3: 7.5
ubuntu
около 3 лет назад

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

redhat логотип

CVE-2022-1473

CVSS3: 7.5
redhat
около 3 лет назад

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

debian логотип

CVE-2022-1473

CVSS3: 7.5
debian
около 3 лет назад

The OPENSSL_LH_flush() function, which empties a hash table, contains ...

github логотип

GHSA-g323-fr93-4j3c

CVSS3: 7.5
github
около 3 лет назад

Resource leakage when decoding certificates and keys

fstec логотип

BDU:2022-03268

CVSS3: 3.7
fstec
около 3 лет назад

Уязвимость реализации функции OPENSSL_LH_flush() библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 47%
0.00238
Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-459
CWE-459