CVE-2022-23462

Summary

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer overflow vulnerability that allows for Denial of Service (DOS) when it parses scientific notation numbers present in JSON. A patch for this issue is available at commit a79d31e4cff1d5a08f665574b29fd885897a28fd in the master branch of the repository. There are no workarounds other than applying the patch.

Affected Software

Weaknesses

• CWE-120: CWE-120 Buffer Overflow
• CWE-121: CWE-121 Stack-based Buffer Overflow

ADP Enrichment

CVE Program Container

Additional References

• https://securitylab.github.com/advisories/GHSL-2022-066_iowow/
• https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://securitylab.github.com/advisories/GHSL-2022-066_iowow/
• https://github.com/Softmotions/iowow/commit/a79d31e4cff1d5a08f665574b29fd885897a28fd

• ←Previous
• Next→