Unrated severityNVD Advisory· Published Jan 12, 2023· Updated Oct 28, 2024
CVE-2022-3437
CVE-2022-3437
Description
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
24- Heimdal/Heimdal GSSAPI librarydescription
- osv-coords21 versionspkg:rpm/opensuse/libheimdal&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/libheimdal&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/samba&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/samba&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/samba&distro=openSUSE%20Leap%20Micro%205.2pkg:rpm/opensuse/samba&distro=openSUSE%20Leap%20Micro%205.3pkg:rpm/opensuse/samba&distro=openSUSE%20Tumbleweedpkg:rpm/suse/libheimdal&distro=SUSE%20Package%20Hub%2015%20SP3pkg:rpm/suse/libheimdal&distro=SUSE%20Package%20Hub%2015%20SP4pkg:rpm/suse/samba&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2012%20SP5pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP3pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP4pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP3pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%202%2015%20SP3pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/samba&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 7.8.0-bp153.2.4.1+ 20 more
- (no CPE)range: < 7.8.0-bp153.2.4.1
- (no CPE)range: < 7.8.0-bp154.2.4.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.591.ab36624310c-150400.3.19.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.591.ab36624310c-150400.3.19.1
- (no CPE)range: < 4.17.2+git.273.a55a83528b9-1.1
- (no CPE)range: < 7.8.0-bp153.2.4.1
- (no CPE)range: < 7.8.0-bp154.2.4.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.482.1ac2c665c7-3.74.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.591.ab36624310c-150400.3.19.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.591.ab36624310c-150400.3.19.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.591.ab36624310c-150400.3.19.1
- (no CPE)range: < 4.15.12+git.535.7750e5c95ef-150300.3.43.1
- (no CPE)range: < 4.15.13+git.482.1ac2c665c7-3.74.1
- (no CPE)range: < 4.15.13+git.482.1ac2c665c7-3.74.1
- (no CPE)range: < 4.15.13+git.482.1ac2c665c7-3.74.1
Patches
Vulnerability mechanics
References
8- security.gentoo.org/glsa/202309-06mitrevendor-advisory
- security.gentoo.org/glsa/202310-06mitrevendor-advisory
- www.openwall.com/lists/oss-security/2023/02/08/1mitremailing-list
- lists.debian.org/debian-lts-announce/2024/04/msg00015.htmlmitremailing-list
- access.redhat.com/security/cve/CVE-2022-3437mitre
- bugzilla.redhat.com/show_bug.cgimitre
- security.netapp.com/advisory/ntap-20230216-0008/mitre
- www.samba.org/samba/security/CVE-2022-3437.htmlmitre
News mentions
0No linked articles in our index yet.