CVE-2022-0586: High severity Wireshark Wireshark vulnerability
Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wiresharkto a version that resolves this vulnerability.Fixed in 4.0.17-0+deb12u3Fixed in 4.4.18-0+deb13u1Fixed in 4.4.19-0+deb13u1Fixed in 4.6.9-1 - Upgrade
Upgrade
alpine/wiresharkto a version that resolves this vulnerability.Fixed in 3.4.13-r0 - Upgrade
Upgrade
debian/wiresharkto a version that resolves this vulnerability.Fixed in 3.6.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-0586?
The severity of CVE-2022-0586 is high.
How does CVE-2022-0586 affect Wireshark?
CVE-2022-0586 affects Wireshark versions 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11.
How can denial of service be triggered in CVE-2022-0586?
Denial of service can be triggered in CVE-2022-0586 through packet injection or crafted capture file.
Which operating systems are affected by CVE-2022-0586?
CVE-2022-0586 affects Wireshark on Fedora 34, Fedora 35, and Debian 9.0.
Where can I find more information about CVE-2022-0586?
You can find more information about CVE-2022-0586 at the following references: [Reference 1](https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0586.json), [Reference 2](https://gitlab.com/wireshark/wireshark/-/issues/17813), [Reference 3](https://lists.debian.org/debian-lts-announce/2022/03/msg00041.html).