PT-2022-4871 · Openwrt · Openwrt

Published 2022-09-19 · Updated 2023-05-24 · CVE-2022-38333

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Openwrt versions prior to 21.02.3 Openwrt version 22.03.0-rc6

Description The issue is related to a buffer overflow vulnerability in the header value function, which allows attackers to access sensitive information via a crafted HTTP request. This can be exploited by sending a specially formed HTTP request, potentially giving a remote attacker access to protected information.

Recommendations For Openwrt versions prior to 21.02.3, update to version 21.02.3 or later. For Openwrt version 22.03.0-rc6, consider disabling the header value function until a patch is available. As a temporary workaround, restrict access to the vulnerable header value function to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2022-05995

CVE-2022-38333

Affected Products

Openwrt

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2022-38333 · Security Note
• https://bdu.fstec.ru/vul/2022-05995 · Security Note
• https://osv.dev/vulnerability/CVE-2022-38333 · Vendor Advisory
• https://git.openwrt.org/?p=project/cgi-io.git%3Ba=patch%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 · Note
• https://t.me/cvenotify/51055 · Telegram Post
• https://git.openwrt.org/?p=project/cgi-io.git;a=patch;h=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 · Note
• https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commitdiff%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 · Note
• https://git.openwrt.org/?p=project/cgi-io.git%3Ba=commit%3Bh=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 · Note
• https://git.openwrt.org/?p=project/cgi-io.git;a=commitdiff;h=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 · Note
• https://t.me/cibsecurity/50068 · Telegram Post
• https://git.openwrt.org/?p=project/cgi-io.git;a=commit;h=901b0f0463c9d16a8cf5b9ed37118d8484bc9176 · Note