CVE-2022-4904

highPriorität · verfolgen · 34EPSS 0.012 · 69. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
1.22% (69th) EPSS
CVSS 8.6 · high
Is it mine?
231 products
Prüfe deine Angriffsfläche
Who says so?
7 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-23

A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.6
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 4.7
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:Csecondary · CISA US
v3.18.6highAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Hsecondary · FSTEC (BDU) RU
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Hsecondary · ENISA EU
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HsecondaryAusnutzbarkeit 3.9 · Auswirkung 4.7
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.17.9highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:Usecondary · CVSS-BT (t0sche)
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Hsecondary · Red Hat Product Security US
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1284USprimärCWE-119USCWE-1284USCWE-1284USCWE-20USCWE-20USCWE-805US
05

betroffene Produkte (231)

Betroffene Produkte und Versionsbereiche.

20 von 231 angezeigt
06

Advisories (11)

Hersteller- und Ökosystem-Meldungen dazu.

  • RHSA-2023:4035Red Hat Security Advisory: nodejs:18 security update2023-07-12csaf · redhat_csafUS

    An update for the nodejs:18 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2023:6291Red Hat Security Advisory: c-ares security update2023-11-02csaf · redhat_csafUS

    An update for c-ares is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2023:6635Red Hat Security Advisory: c-ares security, bug fix, and enhancement update2023-11-07csaf · redhat_csafUS

    An update for c-ares is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2023:7116Red Hat Security Advisory: c-ares security update2023-11-14csaf · redhat_csafUS

    An update for c-ares is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2023:7368Red Hat Security Advisory: c-ares security update2023-11-21csaf · redhat_csafUS

    An update for c-ares is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • RHSA-2023:7543Red Hat Security Advisory: c-ares security update2023-11-28csaf · redhat_csafUS

    An update for c-ares is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • SSA-806742SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.42024-02-13csaf · siemens_psirtDE

    SCALANCE XCM-/XRM-300 before V2.4 is affected by multiple vulnerabilities. Siemens has released an update for SCALANCE X-300 and recommends to update to the latest version.

  • WID-SEC-W-2023-1614Tenable Security Nessus Network Monitor: Mehrere SchwachstellenDeutsch2023-06-29csaf · cert_bundDE

    Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren.

  • WID-SEC-W-2023-2031Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2023-08-09csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.

  • WID-SEC-W-2023-2817Red Hat Enterprise Linux: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-11-02csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • ICSA-24-046-11Siemens SCALANCE XCM-/XRM-3002024-02-13icsa · cisa_csaf_otUS

    SCALANCE XCM-/XRM-300 before V2.4 is affected by multiple vulnerabilities. Siemens has released an update for SCALANCE X-300 and recommends to update to the latest version.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducert_bundcisa_csaf_otredhat_csafsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2023-03-06geändert 2026-06-17
10

Referenzen (22)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan