Sign-up

ID

VAR-202201-0498


CVE

CVE-2022-22826


TITLE

Expat  Integer overflow vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-002874

DESCRIPTION

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Expat ( alias libexpat) Exists in an integer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. The vulnerability is caused by a boundary error when nextScaffoldPart in xmlparse.c exists when processing untrusted input. A remote attacker could exploit this vulnerability to execute arbitrary code on the system. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: expat security update Advisory ID: RHSA-2022:1069-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:1069 Issue date: 2022-03-28 CVE Names: CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 CVE-2022-23852 CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 ==================================================================== 1. Summary: An update for expat is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Expat is a C library for parsing XML documents. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, applications using the Expat library must be restarted for the update to take effect. 5. Package List: Red Hat Enterprise Linux Client (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm ppc64: expat-2.1.0-14.el7_9.ppc.rpm expat-2.1.0-14.el7_9.ppc64.rpm expat-debuginfo-2.1.0-14.el7_9.ppc.rpm expat-debuginfo-2.1.0-14.el7_9.ppc64.rpm expat-devel-2.1.0-14.el7_9.ppc.rpm expat-devel-2.1.0-14.el7_9.ppc64.rpm ppc64le: expat-2.1.0-14.el7_9.ppc64le.rpm expat-debuginfo-2.1.0-14.el7_9.ppc64le.rpm expat-devel-2.1.0-14.el7_9.ppc64le.rpm s390x: expat-2.1.0-14.el7_9.s390.rpm expat-2.1.0-14.el7_9.s390x.rpm expat-debuginfo-2.1.0-14.el7_9.s390.rpm expat-debuginfo-2.1.0-14.el7_9.s390x.rpm expat-devel-2.1.0-14.el7_9.s390.rpm expat-devel-2.1.0-14.el7_9.s390x.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: expat-debuginfo-2.1.0-14.el7_9.ppc.rpm expat-debuginfo-2.1.0-14.el7_9.ppc64.rpm expat-static-2.1.0-14.el7_9.ppc.rpm expat-static-2.1.0-14.el7_9.ppc64.rpm ppc64le: expat-debuginfo-2.1.0-14.el7_9.ppc64le.rpm expat-static-2.1.0-14.el7_9.ppc64le.rpm s390x: expat-debuginfo-2.1.0-14.el7_9.s390.rpm expat-debuginfo-2.1.0-14.el7_9.s390x.rpm expat-static-2.1.0-14.el7_9.s390.rpm expat-static-2.1.0-14.el7_9.s390x.rpm x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: expat-2.1.0-14.el7_9.src.rpm x86_64: expat-2.1.0-14.el7_9.i686.rpm expat-2.1.0-14.el7_9.x86_64.rpm expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-devel-2.1.0-14.el7_9.i686.rpm expat-devel-2.1.0-14.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: expat-debuginfo-2.1.0-14.el7_9.i686.rpm expat-debuginfo-2.1.0-14.el7_9.x86_64.rpm expat-static-2.1.0-14.el7_9.i686.rpm expat-static-2.1.0-14.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-45960 https://access.redhat.com/security/cve/CVE-2021-46143 https://access.redhat.com/security/cve/CVE-2022-22822 https://access.redhat.com/security/cve/CVE-2022-22823 https://access.redhat.com/security/cve/CVE-2022-22824 https://access.redhat.com/security/cve/CVE-2022-22825 https://access.redhat.com/security/cve/CVE-2022-22826 https://access.redhat.com/security/cve/CVE-2022-22827 https://access.redhat.com/security/cve/CVE-2022-23852 https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYkHUz9zjgjWX9erEAQjleA//dK8XzyiK0FY595G0f3CKvLMTMTPEEqf7 3nIHiGzC/lD2o6Y/4ed1iRpndjGVndXyu03AnOFob9P3zqQKBOKiWYcnFNuANAyh WAVTDyjglJ5PvLQe31QHDT1N5KlzN/hskhhyIBgZ+mWq90amXHIX1Xgsy6x72lLD jJF5usHqz4EbIoOn8m0jjDibJFjOOFh2a3qxFnVuMA5+PrcsfnpdVa32I8EMH/sW TODqkz3XLSaaJNWzePOPwZshkriapmU9DqkWdiEVOgJDx0MAn3S5q5MUkHJWRM29 3ZFqQncDQYYYXp8J3AcdX2VXCok0vfIQLWWIvsoGvcpl94lhYsztBGZJttjiVNkV kPX6Wv/W2mMklW7tf0OQOo2Xyh0ZOwB5kfJq7+7SMXzh67M2ifT1Gq7RTAMUProX 3QDm9vVxI7oEBh7HcNychxTaeTwpA2HnGMkUxh0ZX4NkwaOMn0UEBCbxQNXBlPUe 0Qe6srsMV5GSBPk9LoCxpLy+cMc5mya7x1kNS/NZ1CKtqczj4/Oef21I2wqmG/xU 7s9H4o/29X9KhQrOL/sAkqRg2s0yz80Wz1opvXcTgkLj8kzOSN9bQF3ravXXCrUd oqM0cN5PPP/iTqkXs/Dc6HX/iRer15vJ3e4aNu7ZN8+l88mM2BBEmUaDt2ZOHPJb Fq9o8PxEr0c=KN+u -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Description: Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications. Security Fix(es): * Openshift-Gitops: Improper access control allows admin privilege escalation (CVE-2022-1025) * argocd: path traversal and improper access control allows leaking out-of-bound files (CVE-2022-24730) * argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bugs fixed (https://bugzilla.redhat.com/): 2062751 - CVE-2022-24730 argocd: path traversal and improper access control allows leaking out-of-bound files 2062755 - CVE-2022-24731 argocd: path traversal allows leaking out-of-bound files 2064682 - CVE-2022-1025 Openshift-Gitops: Improper access control allows admin privilege escalation 5. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202209-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Expat: Multiple Vulnerabilities Date: September 29, 2022 Bugs: #791703, #830422, #831918, #833431, #870097 ID: 202209-24 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in Expat, the worst of which could result in arbitrary code execution. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/expat < 2.4.9 >= 2.4.9 Description ========== Multiple vulnerabilities have been discovered in Expat. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All Expat users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">\xdev-libs/expat-2.4.9" References ========= [ 1 ] CVE-2021-45960 https://nvd.nist.gov/vuln/detail/CVE-2021-45960 [ 2 ] CVE-2021-46143 https://nvd.nist.gov/vuln/detail/CVE-2021-46143 [ 3 ] CVE-2022-22822 https://nvd.nist.gov/vuln/detail/CVE-2022-22822 [ 4 ] CVE-2022-22823 https://nvd.nist.gov/vuln/detail/CVE-2022-22823 [ 5 ] CVE-2022-22824 https://nvd.nist.gov/vuln/detail/CVE-2022-22824 [ 6 ] CVE-2022-22825 https://nvd.nist.gov/vuln/detail/CVE-2022-22825 [ 7 ] CVE-2022-22826 https://nvd.nist.gov/vuln/detail/CVE-2022-22826 [ 8 ] CVE-2022-22827 https://nvd.nist.gov/vuln/detail/CVE-2022-22827 [ 9 ] CVE-2022-23852 https://nvd.nist.gov/vuln/detail/CVE-2022-23852 [ 10 ] CVE-2022-23990 https://nvd.nist.gov/vuln/detail/CVE-2022-23990 [ 11 ] CVE-2022-25235 https://nvd.nist.gov/vuln/detail/CVE-2022-25235 [ 12 ] CVE-2022-25236 https://nvd.nist.gov/vuln/detail/CVE-2022-25236 [ 13 ] CVE-2022-25313 https://nvd.nist.gov/vuln/detail/CVE-2022-25313 [ 14 ] CVE-2022-25314 https://nvd.nist.gov/vuln/detail/CVE-2022-25314 [ 15 ] CVE-2022-25315 https://nvd.nist.gov/vuln/detail/CVE-2022-25315 [ 16 ] CVE-2022-40674 https://nvd.nist.gov/vuln/detail/CVE-2022-40674 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202209-24 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ====== Copyright 2022 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . For the oldstable distribution (buster), these problems have been fixed in version 2.2.6-2+deb10u2. For the stable distribution (bullseye), these problems have been fixed in version 2.2.10-2+deb11u1. We recommend that you upgrade your expat packages. For the detailed security status of expat please refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIHtfRfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0R5Uw/8Cx7ErfU/j1OgJxyfoRH3/Rz5YNCRzmEzjg7Uh8ZuJl6WfkcvcKvYlCoi /RtUOzYfk2Zg7NHXE86TWOWtbxU1n16n22XwhpbLHAIPuw1GhvwDG6Ctt8U3YAaJ zBReZvw3NSxWJdOD7rTJlAtlQcFpHSUJd2jWjcggZCfySduYMKwLYNzt5+eruwpe YhPKDdZH/MUMe0zOV43qfyYTeP7bqCbpnyhZXk8cNC39SzrJnXwovn7eKmFFCW5x g/ptvOIBJVzh3LxemMyWF4qomQ1rRxGWbkXx46cUQ7alyTcExMnIwBfpzJYCpAKC XV9FvhGS0sfug9NelY9+xpQAvrfCYToHW5niA6OzPuP/Lf7AAWinmGNpxTlYWQcF 1ZxOEQbv8XGikfM74pEsSjIkFwjkLQEFfETaImsvonZf6A3IIhLqkSBsS+j7LNcl ht3uMiJIXkn+iJyDYcCaB0PhgPAqBVk/wk9X01sygzMNrFrYfcX8CeALq5uaZkl6 ut1wYIirLFRKIhuHdGsmt/NKyFIJTzfmaL2W0nvAdLFVxPZQwIzaGxUALo04O+Zn AQj2/JbsAiO2p/N5CXEwtyBNzmJNqlzPlcZ+42uuo/nvsscw2QAL+Yk88XZKwx1B QS4zjj7Lf38+ATT5CFR8m8MTjlv4pUVnYABjx+8LX3pDS3QH4mM= =hLGY -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2022-22826 // JVNDB: JVNDB-2022-002874 // VULHUB: VHN-411552 // PACKETSTORM: 166496 // PACKETSTORM: 166431 // PACKETSTORM: 166433 // PACKETSTORM: 168578 // PACKETSTORM: 169217

AFFECTED PRODUCTS

vendor:tenablemodel:nessusscope:ltversion:8.15.3

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:libexpatmodel:libexpatscope:ltversion:2.4.3

Trust: 1.0

vendor:tenablemodel:nessusscope:ltversion:10.1.1

Trust: 1.0

vendor:siemensmodel:sinema remote connect serverscope:ltversion:3.1

Trust: 1.0

vendor:tenablemodel:nessusscope:gteversion:10.0.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:libexpatmodel:libexpatscope: - version: -

Trust: 0.8

vendor:debianmodel:gnu/linuxscope: - version: -

Trust: 0.8

vendor:tenablemodel:nessusscope: - version: -

Trust: 0.8

vendor:日立model:日立高信頼サーバ rv3000scope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinema remote connect serverscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-002874 // NVD: CVE-2022-22826

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-22826
value: HIGH

Trust: 1.0

NVD: CVE-2022-22826
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202201-641
value: HIGH

Trust: 0.6

VULHUB: VHN-411552
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-22826
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-411552
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-22826
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-22826
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-411552 // JVNDB: JVNDB-2022-002874 // CNNVD: CNNVD-202201-641 // NVD: CVE-2022-22826

PROBLEMTYPE DATA

problemtype:CWE-190

Trust: 1.1

problemtype:Integer overflow or wraparound (CWE-190) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-411552 // JVNDB: JVNDB-2022-002874 // NVD: CVE-2022-22826

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-641

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202201-641

PATCH

title:SSA-484086 Hitachi Server / Client Product Security Informationurl:https://www.debian.org/security/2022/dsa-5073

Trust: 0.8

sources: JVNDB: JVNDB-2022-002874

EXTERNAL IDS

db:NVDid:CVE-2022-22826

Trust: 3.8

db:OPENWALLid:OSS-SECURITY/2022/01/17/3

Trust: 1.7

db:SIEMENSid:SSA-484086

Trust: 1.7

db:TENABLEid:TNS-2022-05

Trust: 1.7

db:ICS CERTid:ICSA-22-167-17

Trust: 1.4

db:PACKETSTORMid:166496

Trust: 0.8

db:PACKETSTORMid:168578

Trust: 0.8

db:ICS CERTid:ICSA-23-278-01

Trust: 0.8

db:JVNid:JVNVU99030761

Trust: 0.8

db:JVNid:JVNVU97425465

Trust: 0.8

db:JVNDBid:JVNDB-2022-002874

Trust: 0.8

db:PACKETSTORMid:167008

Trust: 0.7

db:PACKETSTORMid:169788

Trust: 0.7

db:PACKETSTORMid:166437

Trust: 0.7

db:PACKETSTORMid:166976

Trust: 0.7

db:PACKETSTORMid:166348

Trust: 0.7

db:PACKETSTORMid:169541

Trust: 0.7

db:AUSCERTid:ESB-2022.0626

Trust: 0.6

db:AUSCERTid:ESB-2022.1677

Trust: 0.6

db:AUSCERTid:ESB-2022.1154

Trust: 0.6

db:AUSCERTid:ESB-2022.1263

Trust: 0.6

db:AUSCERTid:ESB-2022.3299

Trust: 0.6

db:AUSCERTid:ESB-2022.4174

Trust: 0.6

db:AUSCERTid:ESB-2022.0369

Trust: 0.6

db:AUSCERTid:ESB-2022.2165

Trust: 0.6

db:AUSCERTid:ESB-2022.0749

Trust: 0.6

db:CS-HELPid:SB2022032013

Trust: 0.6

db:CS-HELPid:SB2022031627

Trust: 0.6

db:CS-HELPid:SB2022021418

Trust: 0.6

db:CS-HELPid:SB2022072710

Trust: 0.6

db:CS-HELPid:SB2022072065

Trust: 0.6

db:CS-HELPid:SB2022060617

Trust: 0.6

db:CS-HELPid:SB2022032843

Trust: 0.6

db:CS-HELPid:SB2022070734

Trust: 0.6

db:CS-HELPid:SB2022041954

Trust: 0.6

db:CS-HELPid:SB2022011713

Trust: 0.6

db:CS-HELPid:SB2022022416

Trust: 0.6

db:CS-HELPid:SB2022070605

Trust: 0.6

db:CS-HELPid:SB2022020902

Trust: 0.6

db:CS-HELPid:SB2022033002

Trust: 0.6

db:CS-HELPid:SB2022032445

Trust: 0.6

db:CS-HELPid:SB2022042116

Trust: 0.6

db:CNNVDid:CNNVD-202201-641

Trust: 0.6

db:PACKETSTORMid:166433

Trust: 0.2

db:PACKETSTORMid:166431

Trust: 0.2

db:PACKETSTORMid:169540

Trust: 0.1

db:CNVDid:CNVD-2022-04543

Trust: 0.1

db:VULHUBid:VHN-411552

Trust: 0.1

db:PACKETSTORMid:169217

Trust: 0.1

sources: VULHUB: VHN-411552 // JVNDB: JVNDB-2022-002874 // PACKETSTORM: 166496 // PACKETSTORM: 166431 // PACKETSTORM: 166433 // PACKETSTORM: 168578 // PACKETSTORM: 169217 // CNNVD: CNNVD-202201-641 // NVD: CVE-2022-22826

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2022-22826

Trust: 1.9

url:https://security.gentoo.org/glsa/202209-24

Trust: 1.8

url:https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Trust: 1.7

url:https://www.tenable.com/security/tns-2022-05

Trust: 1.7

url:https://www.debian.org/security/2022/dsa-5073

Trust: 1.7

url:https://github.com/libexpat/libexpat/pull/539

Trust: 1.7

url:http://www.openwall.com/lists/oss-security/2022/01/17/3

Trust: 1.7

url:https://jvn.jp/vu/jvnvu99030761/index.html

Trust: 0.8

url:https://jvn.jp/vu/jvnvu97425465/index.html

Trust: 0.8

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-17

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-23-278-01

Trust: 0.8

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-167-17

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072710

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022031627

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1154

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022022416

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022041954

Trust: 0.6

url:https://vigilance.fr/vulnerability/expat-six-vulnerabilities-37271

Trust: 0.6

url:https://packetstormsecurity.com/files/166976/red-hat-security-advisory-2022-1734-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022020902

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.4174

Trust: 0.6

url:https://packetstormsecurity.com/files/169541/red-hat-security-advisory-2022-7143-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022021418

Trust: 0.6

url:https://packetstormsecurity.com/files/166348/red-hat-security-advisory-2022-0951-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032843

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022070605

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032445

Trust: 0.6

url:https://packetstormsecurity.com/files/166496/red-hat-security-advisory-2022-1069-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/168578/gentoo-linux-security-advisory-202209-24.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022072065

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1263

Trust: 0.6

url:https://packetstormsecurity.com/files/169788/red-hat-security-advisory-2022-7692-01.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022060617

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022042116

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032013

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022033002

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022011713

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0749

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2165

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0626

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.3299

Trust: 0.6

url:https://packetstormsecurity.com/files/167008/red-hat-security-advisory-2022-1747-01.html

Trust: 0.6

url:https://packetstormsecurity.com/files/166437/red-hat-security-advisory-2022-1039-01.html

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0369

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1677

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022070734

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-45960

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22822

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22827

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2021-46143

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22825

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22823

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-22824

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-23852

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2022-22825

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22822

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-45960

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-25235

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22824

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-25315

Trust: 0.3

url:https://access.redhat.com/articles/11258

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22826

Trust: 0.3

url:https://listman.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.3

url:https://access.redhat.com/security/team/contact/

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-23852

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22827

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-25236

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-25236

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2022-22823

Trust: 0.3

url:https://bugzilla.redhat.com/):

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-25235

Trust: 0.3

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2021-46143

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2022-25315

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0261

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-1025

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23219

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-23177

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-31566

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23219

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23218

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0361

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0261

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-23308

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-24407

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-24407

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0318

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-24731

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23218

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-3999

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-24730

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23308

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0413

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0392

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0361

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-24730

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-23177

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0359

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0318

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0392

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-1025

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0413

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2022-0359

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2021-3999

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-31566

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-23990

Trust: 0.2

url:https://access.redhat.com/security/team/key/

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1069

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25710

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1042

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25709

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2020-25710

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2022-0811

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-0811

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2020-25709

Trust: 0.1

url:https://access.redhat.com/errata/rhsa-2022:1041

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-24731

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-40674

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25314

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-25313

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://security-tracker.debian.org/tracker/expat

Trust: 0.1

sources: VULHUB: VHN-411552 // JVNDB: JVNDB-2022-002874 // PACKETSTORM: 166496 // PACKETSTORM: 166431 // PACKETSTORM: 166433 // PACKETSTORM: 168578 // PACKETSTORM: 169217 // CNNVD: CNNVD-202201-641 // NVD: CVE-2022-22826

CREDITS

Siemens notified CISA of these vulnerabilities.

Trust: 0.6

sources: CNNVD: CNNVD-202201-641

SOURCES

db:VULHUBid:VHN-411552
db:JVNDBid:JVNDB-2022-002874
db:PACKETSTORMid:166496
db:PACKETSTORMid:166431
db:PACKETSTORMid:166433
db:PACKETSTORMid:168578
db:PACKETSTORMid:169217
db:CNNVDid:CNNVD-202201-641
db:NVDid:CVE-2022-22826

LAST UPDATE DATE

2024-09-19T00:44:05.708000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-411552date:2022-10-06T00:00:00
db:JVNDBid:JVNDB-2022-002874date:2023-10-10T06:05:00
db:CNNVDid:CNNVD-202201-641date:2022-11-09T00:00:00
db:NVDid:CVE-2022-22826date:2022-10-06T12:44:28.107

SOURCES RELEASE DATE

db:VULHUBid:VHN-411552date:2022-01-10T00:00:00
db:JVNDBid:JVNDB-2022-002874date:2023-01-19T00:00:00
db:PACKETSTORMid:166496date:2022-03-28T15:54:26
db:PACKETSTORMid:166431date:2022-03-24T14:34:35
db:PACKETSTORMid:166433date:2022-03-24T14:36:50
db:PACKETSTORMid:168578date:2022-09-30T14:56:43
db:PACKETSTORMid:169217date:2022-02-28T20:12:00
db:CNNVDid:CNNVD-202201-641date:2022-01-10T00:00:00
db:NVDid:CVE-2022-22826date:2022-01-10T14:12:57.113