CVE-2022-39028

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-39028
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39028.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39028
Related
Published
2022-08-30T05:15:08Z
Modified
2024-09-18T03:16:46.292327Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

References

Affected packages

Debian:11 / inetutils

Package

Name
inetutils
Purl
pkg:deb/debian/inetutils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:2.0-1+deb11u1

Affected versions

2:2.*

2:2.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / inetutils

Package

Name
inetutils
Purl
pkg:deb/debian/inetutils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:2.3-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / inetutils

Package

Name
inetutils
Purl
pkg:deb/debian/inetutils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:2.3-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / git.hadrons.org/cgit/debian/pkgs/inetutils.git

Affected ranges

Type
GIT
Repo
https://git.hadrons.org/cgit/debian/pkgs/inetutils.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
113da8021710d871c7dd72d2a4d5615d42d64289
Type
GIT
Repo
https://github.com/krb5/krb5
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bad536f50107a1692ad4e19d6e48f31fb2d3a4b6
Type
GIT
Repo
https://github.com/krb5/krb5-appl
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a6c9e0baea1a1030241fe00b0431e5ab454c5fa3

Affected versions

1.*

1.4.2+20030703-1
1.4.2+20030703-7
1.4.2+20030703-8
1.4.2+20031022-1
1.4.2+20040207-1
1.4.2+20040207-2
1.4.2+20040207-3
1.4.2+20040207-4
1.4.2+20040207-5
1.4.2+20040207-6
1.4.3+20051212-1
1.4.3+20051212-2
1.4.3+20051212-3
1.4.3+20051212-4
1.4.3+20060719-1
1.4.3+20060719-2
1.4.3+20060719-3
1.5.dfsg.1-1
1.5.dfsg.1-2
1.5.dfsg.1-3
1.5.dfsg.1-4
1.5.dfsg.1-5
1.5.dfsg.1-6
1.5.dfsg.1-7
1.5.dfsg.1-8
1.5.dfsg.1-9
1.6-1
1.6-2
1.6-3
1.8-1
1.8-2
1.8-3
1.8-4
1.8-5
1.8-6
1.9-1
1.9-2
1.9.1.282-e8541-1
1.9.1.306-0a482-1
1.9.1.363-bbc1-1
1.9.2-1
1.9.2.39.3a460-1
1.9.2.39.3a460-2
1.9.2.39.3a460-3
1.9.3-1
1.9.3-2
1.9.4-1
1.9.4-10
1.9.4-11
1.9.4-12
1.9.4-13
1.9.4-2
1.9.4-3
1.9.4-4
1.9.4-5
1.9.4-6
1.9.4-7
1.9.4-8
1.9.4-9
1.9.4.90-1
1.9.4.91-1

2.*

2.0-1
2.1-1
2.1-2
2.2-1
2.2-2
2.3-1
2.3-2
2.3-3
2.3-4

Other

20030701-1