Log in Start free

Vulnerability · Published May 4, 2022 · Assigned by cisco

CVE-2022-20770ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022

High 8.6

In plain English

A high-severity security flaw in Cisco AMP for Endpoints from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.1% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)7.1%top 5.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12clamav0.103.6+dfsg-1DEBIAN-CVE-2022-20770
Debian:13clamav0.103.6+dfsg-1DEBIAN-CVE-2022-20770
Debian:14clamav0.103.6+dfsg-1DEBIAN-CVE-2022-20770
Ubuntu:22.04:LTSclamav0.103.6+dfsg-0ubuntu0.22.04.1USN-5423-1
Ubuntu:22.04:LTSclamav0.103.6+dfsg-0ubuntu0.22.04.1UBUNTU-CVE-2022-20770

Affected products (as reported)

VendorProductVersions
Cisco Cisco AMP for Endpoints n/a

Weakness: CWE-399 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

References