Vulnerability Description
The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input that would result in a path expansion. We recommend upgrading to 2.6.0 or past commit 52ff00a38447f06a17eab1caa2cf0730a119c751
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tinygltf Project | Tinygltf | < 2.6.0 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053ExploitIssue TrackingMailing List
- https://github.com/syoyo/tinygltf/blob/master/README.mdProductThird Party Advisory
- https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c75PatchThird Party Advisory
- https://github.com/syoyo/tinygltf/issues/368ExploitIssue TrackingPatch
- https://www.debian.org/security/2022/dsa-5232Third Party Advisory
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49053ExploitIssue TrackingMailing List
- https://github.com/syoyo/tinygltf/blob/master/README.mdProductThird Party Advisory
- https://github.com/syoyo/tinygltf/commit/52ff00a38447f06a17eab1caa2cf0730a119c75PatchThird Party Advisory
- https://github.com/syoyo/tinygltf/issues/368ExploitIssue TrackingPatch
- https://www.debian.org/security/2022/dsa-5232Third Party Advisory
FAQ
What is CVE-2022-3008?
CVE-2022-3008 is a vulnerability with a CVSS score of 8.1 (HIGH). The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using ...
How severe is CVE-2022-3008?
CVE-2022-3008 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3008?
Check the references section above for vendor advisories and patch information. Affected products include: Tinygltf Project Tinygltf, Debian Debian Linux.