CVE-2022-37797: Null Pointer Dereference
Published Sep 12, 2022
·Updated
In lighttpd 1.4.65, modwstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
Affected Software
3 affected componentsFixes available
debian/lighttpd<=1.4.53-4+deb10u2
1.4.53-4+deb10u31.4.59-1+deb11u21.4.69-1
Lighttpd Lighttpd=1.4.65
Debian Debian Linux=10.0
Event History
Sep 12, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-37797.
2
What is the severity of CVE-2022-37797?
CVE-2022-37797 has a severity level of 7.5 (high).
3
What software versions are affected by CVE-2022-37797?
CVE-2022-37797 affects Lighttpd version 1.4.65 and possibly other versions.
4
How does CVE-2022-37797 impact the server?
CVE-2022-37797 can cause a server crash and result in a denial of service condition.
5
Are there any patches or fixes available for CVE-2022-37797?
Yes, please refer to the referenced sources for patches and fixes for CVE-2022-37797.