PT-2022-3903 · Open Design Alliance · Open Design Alliance Drawings Sdk

Yonghui Han · Published 2022-04-08 · Updated 2023-06-30 · CVE-2022-28809

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Design Alliance Drawings SDK versions prior to 2023.3

Description An issue exists when reading a DWG file with an invalid vertex number in recovery mode, leading to an Out-of-Bounds Read. This can allow an attacker to execute code in the context of the current process or cause a denial of service.

Recommendations For versions prior to 2023.3, update to version 2023.3 or later to resolve the issue. As a temporary workaround, consider restricting the processing of DWG files with invalid vertex numbers in recovery mode until a patch is available.

Fix

Out of bounds Read

Missing Authentication

Weakness Enumeration

CWE-125

CWE-306

Related Identifiers

BDU:2022-04715

CVE-2022-28809

Affected Products

Open Design Alliance Drawings Sdk

References · 7

• https://opendesign.com/security-advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28809 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04715 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28809 · Security Note
• https://t.me/cvenotify/53437 · Telegram Post
• https://vuldb.com/ru/?id.204066 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-429204.pdf · Note