CVE-2022-41556

CVSS V2 None CVSS V3 High 7.5
Description
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is related to RDHUP mishandling in certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example, affected. This is fixed in 1.4.67.
Overview
  • CVE ID
  • CVE-2022-41556
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-10-06T18:17:03
  • Last Modified Date
  • 2022-12-03T01:14:37
Weakness Enumerations
CWE URL
CWE-401 http://cwe.mitre.org/data/definitions/401.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:lighttpd:lighttpd:*:*:*:*:*:*:*:* 1 OR 1.4.56 1.4.67
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* 1 OR
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • NONE
  • Availability Impact
  • HIGH
  • Base Score
  • 7.5
  • Base Severity
  • HIGH
  • Exploitability Score
  • 3.9
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
https://git.lighttpd.net/lighttpd/lighttpd1.4/commit/b18de6f9264f914f7bf493abd3b6059343548e50 Patch Third Party Advisory
https://github.com/lighttpd/lighttpd1.4/compare/lighttpd-1.4.66...lighttpd-1.4.67 Third Party Advisory
https://github.com/lighttpd/lighttpd1.4/pull/115 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVOSBSCMLGCHH2Z74H64ZWVDFJFQTBC2/ Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202210-12 Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-41556
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41556
History
Created Old Value New Value Data Type Notes
2022-10-06 19:00:58 Added to TrackCVE
2022-12-07 05:37:04 2022-10-06T18:17Z 2022-10-06T18:17:03 CVE Published Date updated
2022-12-07 05:37:04 2022-12-03T01:14:37 CVE Modified Date updated
2022-12-07 05:37:04 Analyzed Vulnerability Status updated
2022-12-07 05:37:11 References updated