Log in Start free

Vulnerability · Published Jan 6, 2022 · Assigned by mitre

CVE-2022-22707

Medium 5.9

In plain English

A medium-severity security flaw in the lighttpd package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.7% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)9.7%top 4.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -1), as demonstrated by remote denial of service (daemon crash) in a non-default configuration. The non-default configuration requires handling of the Forwarded header in a somewhat unusual manner. Also, a 32-bit system is much more likely to be affected than a 64-bit system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20lighttpd1.4.64-r0ALPINE-CVE-2022-22707
Alpine:v3.21lighttpd1.4.64-r0ALPINE-CVE-2022-22707
Alpine:v3.22lighttpd1.4.64-r0ALPINE-CVE-2022-22707
Alpine:v3.23lighttpd1.4.64-r0ALPINE-CVE-2022-22707
Alpine:v3.24lighttpd1.4.64-r0ALPINE-CVE-2022-22707
Debian:12lighttpd1.4.64-1DEBIAN-CVE-2022-22707
Debian:13lighttpd1.4.64-1DEBIAN-CVE-2022-22707
Debian:14lighttpd1.4.64-1DEBIAN-CVE-2022-22707
Ubuntu:22.04:LTSlighttpd1.4.63-1ubuntu3.1UBUNTU-CVE-2022-22707
Ubuntu:22.04:LTSlighttpd1.4.63-1ubuntu3.1USN-5903-1

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References