PT-2024-11907 · Bwoodsend · Rockhopper

Bwoodsend · CVE-2022-4969 · Published 2024-05-27 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions bwoodsend rockhopper versions up to 0.1.2

Description A critical issue has been found in the Binary Parser component, specifically in the count rows function of the rockhopper/src/ragged array.c file. The manipulation of the raw argument leads to a buffer overflow. Local access is required to exploit this issue. Upgrading to version 0.2.0 addresses this issue.

Recommendations For bwoodsend rockhopper versions up to 0.1.2, upgrade to version 0.2.0 to address the issue. As a temporary workaround, consider restricting access to the count rows function in the Binary Parser component until the upgrade is applied.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-4969

GHSA-4R4C-66GF-G9G5

PYSEC-2026-1875

Affected Products

Rockhopper

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4969.json · Exploit
• https://github.com/bwoodsend/rockhopper/releases/tag/v0.2.0 · Patch
• https://github.com/bwoodsend/rockhopper/commit/1a15fad5e06ae693eb9b8908363d2c8ef455104e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4969 · Security Note
• https://osv.dev/vulnerability/GHSA-4r4c-66gf-g9g5 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1875 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4969 · Vendor Advisory
• https://github.com/bwoodsend/rockhopper · Note
• https://pypi.org/project/rockhopper · Note
• https://t.me/cvenotify/82187 · Telegram Post
• https://vuldb.com/?id.266312 · Note
• https://vuldb.com/?ctiid.266312 · Note
• https://t.me/cvenotify/81088 · Telegram Post
• https://github.com/advisories/GHSA-4r4c-66gf-g9g5 · Note