Vulnerability Description
A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation of the argument cas/ttl leads to injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.3 is able to address this issue. The patch is identified as 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to upgrade the affected component.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dalli Project | Dalli | >= -, < 3.2.3 |
Related Weaknesses (CWE)
References
- https://github.com/advisories/GHSA-3xg8-cc8f-9wv2
- https://github.com/petergoldstein/dalli/commit/48d594dae55934476fec61789e7a7c370PatchThird Party Advisory
- https://github.com/petergoldstein/dalli/issues/932ExploitIssue TrackingThird Party Advisory
- https://github.com/petergoldstein/dalli/pull/933PatchThird Party Advisory
- https://github.com/petergoldstein/dalli/releases/tag/v3.2.3
- https://vuldb.com/?ctiid.214026
- https://vuldb.com/?id.214026Third Party Advisory
- https://github.com/petergoldstein/dalli/commit/48d594dae55934476fec61789e7a7c370PatchThird Party Advisory
- https://github.com/petergoldstein/dalli/issues/932ExploitIssue TrackingThird Party Advisory
- https://github.com/petergoldstein/dalli/pull/933PatchThird Party Advisory
- https://vuldb.com/?id.214026Third Party Advisory
FAQ
What is CVE-2022-4064?
CVE-2022-4064 is a vulnerability with a CVSS score of 3.7 (LOW). A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component ...
How severe is CVE-2022-4064?
CVE-2022-4064 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-4064?
Check the references section above for vendor advisories and patch information. Affected products include: Dalli Project Dalli.