PT-2022-19425 · Hawk+2 · Hawk+2

Github-Actionsbot · Published 2022-05-05 · Updated 2024-03-24 · CVE-2022-29167

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hawk versions prior to 9.0.1

Description Hawk is an HTTP authentication scheme that provides mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response. It was found to be vulnerable to a regular expression DoS attack due to the use of a regular expression to parse the Host HTTP header in the Hawk.utils.parseHost() function. This vulnerability allows an attacker to increase the computation time exponentially with each added character in the input. The parseHost() function was patched in version 9.0.1 to use the built-in URL class to parse the hostname instead. The Hawk.authenticate() function accepts an options argument, and if it contains host and port, those will be used instead of a call to utils.parseHost().

Recommendations For versions prior to 9.0.1, update to version 9.0.1 or later to fix the vulnerability. As a temporary workaround, consider passing host and port in the options argument to Hawk.authenticate() to avoid the use of utils.parseHost().

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2022-29167

DLA-3246-1

GHSA-44PW-H2CW-W3VQ

MGASA-2024-0086

OESA-2022-1667

USN-6116-1

Affected Products

Hawk

Linuxmint

Ubuntu

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29167.json · Exploit
• https://github.com/mozilla/hawk/pull/286 · Patch
• https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq · Patch
• https://debian.org/lts/security/2022/dla-3246 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29167 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1667 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6116-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29167 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29167 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0086 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-29167 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44pw-h2cw-w3vq · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3246-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6116-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-29167 · Vendor Advisory