1219872 – (CVE-2022-48623) VUL-0: CVE-2022-48623: perl-Cpanel-JSON-XS: out-of-bounds accesses that could lead to leak of sensitive information or cause a denial of service

Bug 1219872 (CVE-2022-48623) - VUL-0: CVE-2022-48623: perl-Cpanel-JSON-XS: out-of-bounds accesses that could lead to leak of sensitive information or cause a denial of service

Summary: VUL-0: CVE-2022-48623: perl-Cpanel-JSON-XS: out-of-bounds accesses that could...

Status:	NEW

Alias:	CVE-2022-48623

Product:	openSUSE Distribution
Classification:	openSUSE
Component:	Other (show other bugs)
Version:	Leap 15.6
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal (vote)
Target Milestone:	---
Assignee:	Robert Schweikert
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/393841/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2024-02-13 09:50 UTC by SMASH SMASH
Modified:	2024-02-13 10:15 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description SMASH SMASH 2024-02-13 09:50:03 UTC

The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-48623
https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Cpanel-JSON-XS.yml#L25-L36
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.33/changes
https://www.cve.org/CVERecord?id=CVE-2022-48623
https://github.com/rurban/Cpanel-JSON-XS/issues/208

Patch:
https://github.com/rurban/Cpanel-JSON-XS/commit/41f32396eee9395a40f9ed80145c37622560de9b

Comment 1 Andrea Mattiazzo 2024-02-13 09:50:38 UTC

Tracking as affected:
- openSUSE:Backports:SLE-15-SP5/perl-Cpanel-JSON-XS