PT-2022-6762 · Unknown · Csharp-Language-Server-Protocol

CVE-2022-4952 · Published 2022-11-29 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions csharp-language-server-protocol versions up to 0.19.6

Description The issue is related to the function CreateSerializerSettings() of the JSON Serializer component, which can lead to resource consumption when manipulated. This can potentially cause a denial of service. The estimated number of potentially affected devices worldwide is not available.

Recommendations For csharp-language-server-protocol versions up to 0.19.6, upgrade to version 0.19.7 to address the issue. As a temporary workaround, consider restricting the use of the CreateSerializerSettings() function until the patch is applied.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2023-04194

CVE-2022-4952

Affected Products

Csharp-Language-Server-Protocol

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4952.json · Exploit
• https://github.com/OmniSharp/csharp-language-server-protocol/commit/7fd2219f194a9ef2a8901bb131c5fa12272305ce · Patch
• https://github.com/OmniSharp/csharp-language-server-protocol/releases/tag/v0.19.7 · Patch
• https://github.com/OmniSharp/csharp-language-server-protocol/pull/902 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4952 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4952 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04194 · Security Note
• https://vuldb.com/?ctiid.234238 · Note
• https://vuldb.com/?id.234238 · Note