CVE-2022-2529

Summary

sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper Input Validation
• CWE-400: CWE-400 Uncontrolled Resource Consumption

Workarounds

Make sure that the goflow collector is not publicly reachable.

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c

• ←Previous
• Next→