Lucene search

[email protected]CVE-2022-20770

HistoryMay 04, 2022 - 5:15 p.m.

CVE-2022-20770

2022-05-0417:15:08

CWE-399

[email protected]

web.nvd.nist.gov

166

cve

2022

20770

vulnerability

clamav

library

chm

file parser

denial of service

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

7.2 High

AI Score

Confidence

High

0.011 Low

EPSS

Percentile

84.9%

JSON

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Affected configurations

NVD

Node

clamavclamavRange≤0.103.5lts

clamavclamavRange0.104.0–0.104.2

Node

ciscosecure_endpointRange<1.16.3macos

ciscosecure_endpointRange<1.17.2linux

ciscosecure_endpointRange<7.5.5windows

ciscosecure_endpointRange1.18.0–1.18.2linux

ciscosecure_endpointRange1.18.0–1.18.2macos

Node

fedoraprojectfedoraMatch34

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

Node

debiandebian_linuxMatch9.0

CPENameOperatorVersion
clamav:clamavclamavle0.103.5
clamav:clamavclamavle0.104.2

CPE	Name	Operator	Version
clamav:clamav	clamav	le	0.103.5
clamav:clamav	clamav	le	0.104.2

CNA Affected

[
  {
    "vendor": "Cisco",
    "product": "Cisco AMP for Endpoints ",
    "versions": [
      {
        "version": "n/a",
        "status": "affected"
      }
    ]
  }
]