PT-2022-25436 · Dalli · Dalli

Xhzeem · Published 2022-11-19 · Updated 2025-03-28 · CVE-2022-4064

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dalli (affected versions not specified)

Description A vulnerability was found in the function self.meta set of the file lib/dalli/protocol/meta/request formatter.rb of the component Meta Protocol Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. As a temporary workaround, consider disabling the self.meta set function until a patch is available.

Exploit

Fix

Improper Neutralization

Special Elements Injection

Weakness Enumeration

CWE-707

CWE-74

Related Identifiers

CVE-2022-4064

GHSA-3XG8-CC8F-9WV2

OESA-2023-1002

Affected Products

Dalli

References · 19

• 🔥 https://github.com/petergoldstein/dalli/issues/932 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dalli/CVE-2022-4064.yml · Exploit
• https://github.com/petergoldstein/dalli/releases/tag/v3.2.3 · Patch
• https://github.com/petergoldstein/dalli/commit/48d594dae55934476fec61789e7a7c3700e0f50d · Patch
• https://github.com/petergoldstein/dalli/pull/933 · Patch
• https://ubuntu.com/security/CVE-2022-4064 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-4064 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1002 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3xg8-cc8f-9wv2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4064 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4064 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4064 · Vendor Advisory
• https://github.com/petergoldstein/dalli · Note
• https://vuldb.com/?ctiid.214026 · Note
• https://t.me/cibsecurity/53205 · Telegram Post