CVE-2022-3515

2023-01-1215:15:10

CWE-190

[email protected]

web.nvd.nist.gov

891

vulnerability

libksba

code execution

integer overflow

crl parser

remote exploit

nvd

cve-2022-3515

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

75.6%

JSON

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

Affected configurations

Vulners

NVD

Node

libksba_librarylibksba_libraryRange≤1.6.2

VendorProductVersionCPE
libksba_librarylibksba_library*cpe:2.3:a:libksba_library:libksba_library:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libksba_library	libksba_library	*	cpe:2.3:a:libksba_library:libksba_library::::::::

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libksba",
    "versions": [
      {
        "version": "Fixed in libksba v1.6.2",
        "status": "affected"
      }
    ]
  }
]