CVE Vulnerabilities

CVE-2022-26766

Improper Certificate Validation

Published: May 26, 2022 | Modified: Jun 08, 2022
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

Name Vendor Start Version End Version
Ipados Apple * 15.5 (excluding)
Iphone_os Apple * 15.5 (excluding)
Mac_os_x Apple * 10.15.7 (excluding)
Mac_os_x Apple 10.15.7 (including) 10.15.7 (including)
Mac_os_x Apple 10.15.7-security_update_2020-001 (including) 10.15.7-security_update_2020-001 (including)
Mac_os_x Apple 10.15.7-security_update_2021-001 (including) 10.15.7-security_update_2021-001 (including)
Mac_os_x Apple 10.15.7-security_update_2021-002 (including) 10.15.7-security_update_2021-002 (including)
Mac_os_x Apple 10.15.7-security_update_2021-003 (including) 10.15.7-security_update_2021-003 (including)
Mac_os_x Apple 10.15.7-security_update_2021-004 (including) 10.15.7-security_update_2021-004 (including)
Mac_os_x Apple 10.15.7-security_update_2021-005 (including) 10.15.7-security_update_2021-005 (including)
Mac_os_x Apple 10.15.7-security_update_2021-006 (including) 10.15.7-security_update_2021-006 (including)
Mac_os_x Apple 10.15.7-security_update_2021-007 (including) 10.15.7-security_update_2021-007 (including)
Mac_os_x Apple 10.15.7-security_update_2021-008 (including) 10.15.7-security_update_2021-008 (including)
Mac_os_x Apple 10.15.7-security_update_2022-001 (including) 10.15.7-security_update_2022-001 (including)
Mac_os_x Apple 10.15.7-security_update_2022-002 (including) 10.15.7-security_update_2022-002 (including)
Mac_os_x Apple 10.15.7-security_update_2022-003 (including) 10.15.7-security_update_2022-003 (including)
Macos Apple 11.0 (including) 11.6.6 (excluding)
Macos Apple 12.0 (including) 12.4 (excluding)
Tvos Apple * 15.5 (excluding)
Watchos Apple * 8.6 (excluding)

Potential Mitigations

References