CVE-2022-0497: High severity Openscad Openscad vulnerability
A .scad file with no trailing newline may cause an out-of-bounds read during parsing of annotations.
References:
https://github.com/openscad/openscad/issues/4043 https://github.com/openscad/openscad/pull/4044
Other sources
A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annotations.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openscadto a version that resolves this vulnerability.Fixed in 2021.01-6Fixed in 2021.01-8Fixed in 2021.01-14 - Upgrade
Upgrade
alpine/openscadto a version that resolves this vulnerability.Fixed in 2021.01-r2 - Upgrade
Upgrade
debian/openscadto a version that resolves this vulnerability.Fixed in 2021.01-4
Event History
Frequently Asked Questions
What is CVE-2022-0497?
CVE-2022-0497 is a vulnerability found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annotations.
What software is affected by CVE-2022-0497?
Openscad versions up to and excluding 2022-01-09 are affected by CVE-2022-0497.
How severe is CVE-2022-0497?
CVE-2022-0497 has a severity level of 7.1 (high).
How can I fix CVE-2022-0497?
To fix CVE-2022-0497, you should update Openscad to a version released after 2022-01-09.
Where can I find more information about CVE-2022-0497?
More information about CVE-2022-0497 can be found on the following references: [link1](https://github.com/openscad/openscad/issues/4043), [link2](https://github.com/openscad/openscad/pull/4044), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2050700).