by Kastro
Paper/Archive/CVE-2022-3515

CVE-2022-3515

redhat — A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser.

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 77.3.773 × 2015.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Affected

ProductAffectedFixed inSource
libksbaFixed in libksba v1.6.2–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refbugzilla.redhat.com/show_bug.cgi?id=2135610refgnupg.org/blog/20221017-pepe-left-the-ksba.htmlrefdev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582brefaccess.redhat.com/security/cve/CVE-2022-3515refsecurity.netapp.com/advisory/ntap-20230706-0008