Vulnerability · Published Jan 12, 2023 · Assigned by redhat
CVE-2022-3515
Critical 9.8
In plain English
A critical-severity integer overflow in libksba. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.7%top 22.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libksba | 1.3.5-8.el8_6 | ALSA-2022:7089 |
| AlmaLinux:9 | libksba | 1.5.1-5.el9_0 | ALSA-2022:7090 |
| AlmaLinux:8 | libksba-devel | 1.3.5-8.el8_6 | ALSA-2022:7089 |
| AlmaLinux:9 | libksba-devel | 1.5.1-5.el9_0 | ALSA-2022:7090 |
| Alpine:v3.20 | libksba | 1.6.2-r0 | ALPINE-CVE-2022-3515 |
| Alpine:v3.21 | libksba | 1.6.2-r0 | ALPINE-CVE-2022-3515 |
| Alpine:v3.22 | libksba | 1.6.2-r0 | ALPINE-CVE-2022-3515 |
| Alpine:v3.23 | libksba | 1.6.2-r0 | ALPINE-CVE-2022-3515 |
| Alpine:v3.24 | libksba | 1.6.2-r0 | ALPINE-CVE-2022-3515 |
| Debian:12 | libksba | 1.6.2-1 | DEBIAN-CVE-2022-3515 |
| Debian:13 | libksba | 1.6.2-1 | DEBIAN-CVE-2022-3515 |
| Debian:14 | libksba | 1.6.2-1 | DEBIAN-CVE-2022-3515 |
| Rocky Linux:8 | libksba | 0:1.3.5-8.el8_6 | RLSA-2022:7089 |
| Rocky Linux:9 | libksba | 0:1.5.1-5.el9_0 | RLSA-2022:7090 |
| Ubuntu:22.04:LTS | libksba | 1.6.0-2ubuntu0.1 | UBUNTU-CVE-2022-3515 |
| Ubuntu:22.04:LTS | libksba | 1.6.0-2ubuntu0.1 | USN-5688-1 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H