CVE-2022-37797
Summary
| CVE | CVE-2022-37797 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-09-12 15:15:00 UTC |
|---|
| Updated | 2022-12-03 01:11:00 UTC |
|---|
| Description | In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Bug #3165: mod_wstunnel null pointer dereference - Lighttpd - lighty labs |
MISC |
redmine.lighttpd.net |
|
| [SECURITY] [DLA 3133-1] lighttpd security update |
MLIST |
lists.debian.org |
|
| Lighttpd: Denial of Service (GLSA 202210-12) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| Debian -- Security Information -- DSA-5243-1 lighttpd |
DEBIAN |
www.debian.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181083 Debian Security Update for lighttpd (DSA 5243-1)
- 181100 Debian Security Update for lighttpd (DLA 3133-1)
- 182453 Debian Security Update for lighttpd (CVE-2022-37797)
- 354847 Amazon Linux Security Advisory for lighttpd : ALAS-2023-1705
- 710656 Gentoo Linux Lighttpd Denial of Service Vulnerability (GLSA 202210-12)
