CVE-2022-40468: High severity Tinyproxy Project Tinyproxy vulnerability
Last updated 6 January 2025
Other sources
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in processrequest() function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/tinyproxyto a version that resolves this vulnerability.Fixed in 1.10.0-5+deb11u1Fixed in 1.11.1-2.1+deb12u1Fixed in 1.11.2-1 - Upgrade
Upgrade
tinyproxyto a version that resolves this vulnerability.Patch 84f203f - Compensating control
If custom error page templates using special non-standard variables are used, avoid them or remove the non-standard variables to prevent potential leakage of left-over heap data.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-40468?
CVE-2022-40468 is classified as a medium severity vulnerability due to the potential leak of sensitive data from uninitialized buffers.
How do I fix CVE-2022-40468?
To fix CVE-2022-40468, update Tinyproxy to version 1.10.0-5+deb11u1, 1.11.1-2.1+deb12u1, or 1.11.2-1.
What are the affected versions for CVE-2022-40468?
CVE-2022-40468 affects Tinyproxy versions up to and including 1.11.1.
What specifically causes CVE-2022-40468?
CVE-2022-40468 is caused by the use of uninitialized buffers in the process_request() function when custom error page templates are used.
Is there a workaround for CVE-2022-40468?
Currently, no specific workaround is recommended for CVE-2022-40468 other than updating to a patched version.