CVEvulnerability
CVE-2022-3515
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2023-01-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-190
Description
A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.
Affected configurations
• gnupg libksba (< 1.6.3)
• gpg4win gpg4win (>= 2.0.0 < 4.1.0)
• gnupg vs-desktop (>= 3.1.16 < 3.1.26)
• gnupg gnupg (>= 2.1.0 < 2.2.41)
• gnupg gnupg (>= 2.3.0 < 2.4.0)
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- https://access.redhat.com/security/cve/CVE-2022-3515 Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2135610 Exploit, Issue Tracking, Third Party Advisory
- https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b Exploit, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230706-0008/ security.netapp.com
- https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-3515 Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2135610 Exploit, Issue Tracking, Third Party Advisory
- https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b Exploit, Patch, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230706-0008/ security.netapp.com
- https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html Third Party Advisory