CVE-2022-39028

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

References

Affected packages

Git / git.hadrons.org/cgit/debian/pkgs/inetutils.git

Affected ranges

Type: GIT
Repo: https://git.hadrons.org/cgit/debian/pkgs/inetutils.git
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

113da8021710d871c7dd72d2a4d5615d42d64289

Type

GIT

Repo

https://github.com/krb5/krb5

Events

Introduced

Last affected

bad536f50107a1692ad4e19d6e48f31fb2d3a4b6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.3"
        }
    ]
}

Affected versions

1.*

1.4.2+20030703-1

1.4.2+20030703-7

1.4.2+20030703-8

1.4.2+20031022-1

1.4.2+20040207-1

1.4.2+20040207-2

1.4.2+20040207-3

1.4.2+20040207-4

1.4.2+20040207-5

1.4.2+20040207-6

1.4.3+20051212-1

1.4.3+20051212-2

1.4.3+20051212-3

1.4.3+20051212-4

1.4.3+20060719-1

1.4.3+20060719-2

1.4.3+20060719-3

1.5.dfsg.1-1

1.5.dfsg.1-2

1.5.dfsg.1-3

1.5.dfsg.1-4

1.5.dfsg.1-5

1.5.dfsg.1-6

1.5.dfsg.1-7

1.5.dfsg.1-8

1.5.dfsg.1-9

1.6-1

1.6-2

1.6-3

1.8-1

1.8-2

1.8-3

1.8-4

1.8-5

1.8-6

1.9-1

1.9-2

1.9.1.282-e8541-1

1.9.1.306-0a482-1

1.9.1.363-bbc1-1

1.9.2-1

1.9.2.39.3a460-1

1.9.2.39.3a460-2

1.9.2.39.3a460-3

1.9.3-1

1.9.3-2

1.9.4-1

1.9.4-10

1.9.4-11

1.9.4-12

1.9.4-13

1.9.4-2

1.9.4-3

1.9.4-4

1.9.4-5

1.9.4-6

1.9.4-7

1.9.4-8

1.9.4-9

1.9.4.90-1

1.9.4.91-1

2.*

2.0-1

2.1-1

2.1-2

2.2-1

2.2-2

2.3-1

2.3-2

2.3-3

2.3-4

Other

20030701-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39028.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "0.17"
            }
        ]
    }
]