CVE-2022-37797

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2022-37797 lighttpd Corrigé dans: 1.4.59-1+deb11u2

Références

advisory github.com
advisory nvd.nist.gov
advisory security.gentoo.org
advisory debian.org
web redmine.lighttpd.net
web lists.debian.org