Lucene search

MitreCVE-2022-37434

HistoryAug 05, 2022 - 7:15 a.m.

CVE-2022-37434

2022-08-0507:15:07

CWE-787

mitre

web.nvd.nist.gov

734

zlib

cve-2022-37434

heap-based buffer overflow

inflate.c

nvd

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.003

Percentile

71.6%

JSON

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Affected configurations

Nvd

Node

zlibzlibRange≤1.2.12

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

Node

debiandebian_linuxMatch10.0

Node

netappactive_iq_unified_managerMatch-vmware_vsphere

netappactive_iq_unified_managerMatch-windows

netapphciMatch-

netappmanagement_services_for_element_softwareMatch-

netapponcommand_workflow_automationMatch-

netappontap_select_deploy_administration_utilityMatch-

netappstoragegridMatch-

netapphci_compute_nodeMatch-

Node

netapph300s_firmwareMatch-

AND

netapph300sMatch-

Node

netapph500s_firmwareMatch-

AND

netapph500sMatch-

Node

netapph700s_firmwareMatch-

AND

netapph700sMatch-

Node

netapph700s_firmwareMatch-

AND

netapph700sMatch-

Node

appleipadosRange<15.7.1

appleiphone_osRange<15.7.1

appleiphone_osRange16.0–16.1

applemacosRange11.0–11.7.1

applemacosRange12.0.0–12.6.1

applewatchosRange<9.1

Node

stormshieldstormshield_network_securityRange3.7.31–3.7.34

stormshieldstormshield_network_securityRange3.11.0–3.11.22

stormshieldstormshield_network_securityRange4.3.0–4.3.16

stormshieldstormshield_network_securityRange4.6.0–4.6.3

VendorProductVersionCPE
zlibzlib*cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*
fedoraprojectfedora35cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
fedoraprojectfedora36cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraprojectfedora37cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netappactive_iq_unified_manager-cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
netapphci-cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
netappmanagement_services_for_element_software-cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
netapponcommand_workflow_automation-cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zlib	zlib	*	cpe:2.3:a:zlib:zlib::::::::
fedoraproject	fedora	35	cpe:2.3:o:fedoraproject:fedora:35:::::::*
fedoraproject	fedora	36	cpe:2.3:o:fedoraproject:fedora:36:::::::*
fedoraproject	fedora	37	cpe:2.3:o:fedoraproject:fedora:37:::::::*
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
netapp	active_iq_unified_manager	-	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
netapp	active_iq_unified_manager	-	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::
netapp	hci	-	cpe:2.3:a:netapp:hci:-:::::::*
netapp	management_services_for_element_software	-	cpe:2.3:a:netapp:management_services_for_element_software:-:::::::*
netapp	oncommand_workflow_automation	-	cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::*