CVE-2022-23098: An issue was discovered in the DNS proxy in Connman through 1.40

High severity · published Jan 28, 2022

CVE-2022-23098

An issue was discovered in the DNS proxy in Connman through 1.40

7.5

CVSS

2.5%

EPSS

On KEV

Description

An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.5% · higher than 85% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Connman · Intel

through 1.40 · source: NVD

Debian Linux · Debian

9.0; 11.0 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-23098

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-23098

Product

https://git.kernel.org/pub/scm/network/connman/connman.git/log/

Mailing List

https://lists.debian.org/debian-lts-announce/2022/02/msg00009.html

Third Party Advisory

https://security.gentoo.org/glsa/202310-21

Third Party Advisory

https://www.debian.org/security/2022/dsa-5231

Exploit

https://www.openwall.com/lists/oss-security/2022/01/25/1