CVE-2022-40468
Summary
| CVE | CVE-2022-40468 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-09-19 17:15:00 UTC |
|---|
| Updated | 2023-05-21 22:15:00 UTC |
|---|
| Description | Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Potential runtime system sensitive information disclosure through special HTTP requests. · Issue #457 · tinyproxy/tinyproxy · GitHub |
MISC |
github.com |
|
| tinyproxy/reqs.c at 84f203fb1c4733608c7283bbe794005a469c4b00 · tinyproxy/tinyproxy · GitHub |
MISC |
github.com |
|
| Tinyproxy: Memory Disclosure (GLSA 202305-27) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| GitHub - tinyproxy/tinyproxy: tinyproxy - a light-weight HTTP/HTTPS proxy daemon for POSIX operating systems |
MISC |
github.com |
|
| Potential runtime system sensitive information disclosure through special HTTP requests. · Issue #457 · tinyproxy/tinyproxy · GitHub |
MISC |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 184192 Debian Security Update for tinyproxy (CVE-2022-40468)
- 502606 Alpine Linux Security Update for tinyproxy
- 504476 Alpine Linux Security Update for tinyproxy
- 710730 Gentoo Linux Tinyproxy Memory Disclosure Vulnerability (GLSA 202305-27)
