CVE Vulnerabilities

CVE-2022-37797

NULL Pointer Dereference

Published: Sep 12, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Weakness

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Affected Software

Name Vendor Start Version End Version
Lighttpd Lighttpd 1.4.65 (including) 1.4.65 (including)
Lighttpd Ubuntu esm-apps/focal *
Lighttpd Ubuntu esm-apps/jammy *
Lighttpd Ubuntu focal *
Lighttpd Ubuntu jammy *
Lighttpd Ubuntu kinetic *
Lighttpd Ubuntu lunar *
Lighttpd Ubuntu trusty *
Lighttpd Ubuntu upstream *
Lighttpd Ubuntu xenial *

Potential Mitigations

References