PT-2024-11907 · Bwoodsend · Rockhopper

Bwoodsend · Published 2024-05-27 · Updated 2024-06-06 · CVE-2022-4969

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions bwoodsend rockhopper versions up to 0.1.2

Description A critical issue has been found in the Binary Parser component, specifically in the count rows function of the rockhopper/src/ragged array.c file. The manipulation of the raw argument leads to a buffer overflow. Local access is required to exploit this issue. Upgrading to version 0.2.0 addresses this issue.

Recommendations For bwoodsend rockhopper versions up to 0.1.2, upgrade to version 0.2.0 to address the issue. As a temporary workaround, consider restricting access to the count rows function in the Binary Parser component until the upgrade is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-4969

GHSA-4R4C-66GF-G9G5

Affected Products

Rockhopper

References · 10

• https://github.com/bwoodsend/rockhopper/releases/tag/v0.2.0 · Patch
• https://github.com/bwoodsend/rockhopper/commit/1a15fad5e06ae693eb9b8908363d2c8ef455104e · Patch
• https://osv.dev/vulnerability/CVE-2022-4969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4969 · Security Note
• https://osv.dev/vulnerability/GHSA-4r4c-66gf-g9g5 · Vendor Advisory
• https://github.com/bwoodsend/rockhopper · Note
• https://vuldb.com/?id.266312 · Note
• https://vuldb.com/?ctiid.266312 · Note
• https://t.me/cvenotify/81088 · Telegram Post
• https://t.me/cvenotify/82187 · Telegram Post