PT-2022-16029 · Yauaa · Yauaa

Nielsbasjes · Published 2022-12-08 · Updated 2022-12-12 · CVE-2022-23496

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Yet Another UserAgent Analyzer (Yauaa) versions 7.0.0 through 7.8.x

Description The Yauaa library can throw an ArrayIndexOutOfBoundsException when analyzing useragent strings, potentially causing applications to crash if the exception is uncaught. This issue affects applications using the Client Hints analysis feature introduced with version 7.0.0. Applications not using this feature are not affected.

Recommendations For versions 7.0.0 through 7.8.x, upgrade to version 7.9.0 to resolve the issue. For users unable to upgrade, catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library as a temporary workaround.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2022-23496

GHSA-C4PM-63CG-9J7H

Affected Products

Yauaa

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23496.json · Exploit
• https://github.com/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9e · Patch
• https://osv.dev/vulnerability/GHSA-c4pm-63cg-9j7h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23496 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23496 · Vendor Advisory
• https://github.com/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7h · Note
• https://github.com/nielsbasjes/yauaa · Note
• https://t.me/cibsecurity/54206 · Telegram Post
• https://t.me/cvenotify/39487 · Telegram Post