CVE-2022-37797: Null Pointer Dereference
First published: Mon Sep 12 2022(Updated: )
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lighttpd Lighttpd | =1.4.65 | |
| Debian Debian Linux | =10.0 | |
| debian/lighttpd | <=1.4.53-4+deb10u2 | 1.4.53-4+deb10u3 1.4.59-1+deb11u2 1.4.69-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.debian.org/debian-lts-announce/2022/10/msg00002.html
- https://redmine.lighttpd.net/issues/3165
- https://security.gentoo.org/glsa/202210-12
- https://www.debian.org/security/2022/dsa-5243
- https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/971773f1fae600074b46ef64f3ca1f76c227985f
- https://security-tracker.debian.org/tracker/CVE-2022-37797
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-37797.
What is the severity of CVE-2022-37797?
CVE-2022-37797 has a severity level of 7.5 (high).
What software versions are affected by CVE-2022-37797?
CVE-2022-37797 affects Lighttpd version 1.4.65 and possibly other versions.
How does CVE-2022-37797 impact the server?
CVE-2022-37797 can cause a server crash and result in a denial of service condition.
Are there any patches or fixes available for CVE-2022-37797?
Yes, please refer to the referenced sources for patches and fixes for CVE-2022-37797.
- collector/nvd-index
- collector/security-tracker-debian
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/lighttpd
- canonical/lighttpd lighttpd
- version/lighttpd lighttpd/1.4.65
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- package-manager/debian