CVE-2022-37797: Null Pointer Dereference
In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/lighttpdto a version that resolves this vulnerability.Fixed in 1.4.69-1Fixed in 1.4.79-2Fixed in 1.4.85-1 - Upgrade
Upgrade
debian/lighttpdto a version that resolves this vulnerability.Fixed in 1.4.66-1
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-37797.
What is the severity of CVE-2022-37797?
CVE-2022-37797 has a severity level of 7.5 (high).
What software versions are affected by CVE-2022-37797?
CVE-2022-37797 affects Lighttpd version 1.4.65 and possibly other versions.
How does CVE-2022-37797 impact the server?
CVE-2022-37797 can cause a server crash and result in a denial of service condition.
Are there any patches or fixes available for CVE-2022-37797?
Yes, please refer to the referenced sources for patches and fixes for CVE-2022-37797.