PT-2022-4459 · Unknown+16 · Mysql Server+15
Evgeny Legerov
·
Published
2022-08-05
·
Updated
2026-03-10
·
CVE-2022-37434
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
zlib versions 1.2.12 and earlier
MySQL Server versions 5.7.41 and earlier, 8.0.31 and earlier
Description
The issue is related to a heap-based buffer over-read or buffer overflow in the inflate function of the zlib library, specifically in the inflate.c component. This can be triggered by a large gzip header extra field. Only applications that call
inflateGetHeader are affected. The exploitation of this issue may allow a remote attacker to execute arbitrary code on the system. It is also noted that some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader.Recommendations
For zlib versions 1.2.12 and earlier, update to a version that includes improved checks to address the heap-based buffer overflow issue.
For MySQL Server versions 5.7.41 and earlier, 8.0.31 and earlier, consider restricting access to minimize the risk of exploitation until a patch is available.
As a temporary workaround, consider disabling the
inflateGetHeader function in affected applications until a patch is available.Exploit
Fix
DoS
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Freebsd
Ibm Aix
Linuxmint
Apple Macos
Mysql Server
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zlib