Vulnerability · Published Nov 21, 2022 · Assigned by VulDB

CVE-2022-4087iPXE TLS tls.c tls_new_ciphertext information exposure

Low 2.6

In plain English

A low-severity improper access control in iPXE from unspecified. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)2.6Low

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
unspecified	iPXE	n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References