Integer overflow in libksba - CVE-2022-47629

Vulnerability identifier: #VU70474

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-47629

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the CRL signature parser. A remote attacker can pass specially crafted data to the application, trigger an integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libksba
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
EMC ECS
Tanzu Greenplum for Kubernetes
ObjectScale
Cloud Pak for Network Automation
PowerStore T
Platform Automation Toolkit
IBM Cloud Pak for Watson AIOps
IBM supplied MQ Advanced container images
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
Amazon Linux AMI
Debian Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Power, little endian
CentOS
Anolis OS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
NetObserv Operator
Migration Toolkit for Runtimes
Service Telemetry Framework
Cryostat
Ansible Automation Platform
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
Red Hat OpenStack
Oracle Communications Cloud Native Core Network Exposure Function
Netcool Operations Insight
IBM MQ Operator
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
Data Replication on Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Node Health Check Operator
Self Node Remediation Operator
Red Hat OpenShift Serverless
OpenShift sandboxed containers
OpenShift Service Mesh
OpenShift Data Foundation (formerly OpenShift Container Storage)
Node Maintenance Operator
Red Hat OpenShift Data Science
VMware Tanzu Operations Manager
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
OpenShift API for Data Protection (OADP)
Red Hat OpenShift GitOps
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM Edge Application Manager
Oracle Communications Cloud Native Configuration Console
Dell EMC Container Storage Modules
OpenShift Developer Tools and Services
Red Hat Single Sign-On
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libksba8 (Ubuntu package)
libksba
libksba-devel
libksba (Red Hat package)
libksba8
libksba-debugsource
libksba8-debuginfo
libksba-debuginfo
libksba-help
libksba (Debian package)
dev-libs/libksba
redhat-release-virtualization-host (Red Hat package)
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Unified Data Repository
Cloud Pak for Security (CP4S)
JBoss Enterprise Application Platform expansion pack (EAP XP)
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
Dell EMC VxRail Appliance

Install updates from vendor's website.

libksba - update to 1.6.3
NetObserv Operator - update to 1.1.0
Node Health Check Operator - update to 0.4.1
Self Node Remediation Operator - update to 0.5.1
Red Hat OpenShift Serverless - update to 1.27.1
Migration Toolkit for Runtimes - update to 1.0.2
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.1.1
OpenShift API for Data Protection (OADP) - update to 1.1.2
OpenShift sandboxed containers - update to 1.4.1
Service Telemetry Framework - update to 1.5.2
Red Hat OpenShift GitOps - addressed in versions 1.12.5, 1.13.1
Migration Toolkit for Containers - addressed in versions 1.7.8, 1.7.10
OpenShift Service Mesh - addressed in versions 2.3.2, 2.4.8, 2.5.2
Migration Toolkit for Virtualization - update to 2.4.3
Red Hat Advanced Cluster Management for Kubernetes - update to 2.6.4
EMC ECS - update to 3.7.0.6
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.9.56, 4.10.52, 4.11.27, 4.11.45, 4.12.4, 4.13.0, 4.13.2, 4.13.45, 4.14.32, 4.14.33
OpenShift Developer Tools and Services - update to 4.9
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.12.1, 4.13.0
Node Maintenance Operator - update to 5.0.1
OpenShift Logging - update to 5.4.11
Red Hat Migration Toolkit for Applications - update to 6.0.1
Red Hat Single Sign-On - update to 7.6.2
libksba8 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.3.5-2ubuntu0.18.04.2, 1.3.5-2ubuntu0.20.04.2, 1.6.0-2ubuntu0.2, 1.6.0-3ubuntu1.1
Tanzu Greenplum for Kubernetes - update to 1.2.0
libksba - addressed in versions 1.3.0-7, 1.3.5-9.0.1
libksba-devel - update to 1.3.0-7
libksba (Red Hat package) - addressed in versions 1.3.0-7.el7_9, 1.3.5-9.el8_1, 1.3.5-9.el8_2, 1.3.5-9.el8_4, 1.3.5-9.el8_6, 1.3.5-9.el8_7, 1.5.1-6.el9_0, 1.5.1-6.el9_1
libksba8 - addressed in versions 1.3.0-24.6.1, 1.3.5-150000.4.6.1
libksba-devel - addressed in versions 1.3.0-24.6.1, 1.3.5-150000.4.6.1
libksba-debugsource - addressed in versions 1.3.0-24.6.1, 1.3.5-150000.4.6.1
libksba8-debuginfo - addressed in versions 1.3.0-24.6.1, 1.3.5-150000.4.6.1
libksba - update to 1.3.5-1.11
ObjectScale - update to 1.4.0
libksba-debuginfo - addressed in versions 1.4.0-4, 1.6.0-3
libksba - addressed in versions 1.4.0-4, 1.6.0-3
libksba-debugsource - addressed in versions 1.4.0-4, 1.6.0-3
libksba-devel - addressed in versions 1.4.0-4, 1.6.0-3
libksba-help - addressed in versions 1.4.0-4, 1.6.0-3
libksba (Debian package) - update to 1.5.0-3+deb11u2
Dell EMC Container Storage Modules - update to 1.6.0
libksba - update to 1.6.3
dev-libs/libksba - update to 1.6.3
Netcool Operations Insight - update to 1.6.9
Cloud Pak for Security (CP4S) - update to 1.10.12.0
Red Hat OpenShift Data Science - update to 1.22.1
IBM MQ Operator - addressed in versions 2.0.8, 2.3.0
Cloud Pak for Network Automation - update to 2.4.5
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-376
VMware Tanzu Operations Manager - update to 3.0.3
PowerStore T - update to 3.5.0.1-2083289
Red Hat OpenShift Dev Spaces - addressed in versions 3.15.0, 3.16.0
JBoss Enterprise Application Platform expansion pack (EAP XP) - update to 4.0.0
Platform Automation Toolkit - addressed in versions 4.0.13, 4.1.13, 4.2.8, 4.3.5
IBM Cloud Pak for Watson AIOps - update to 4.1.1
redhat-release-virtualization-host (Red Hat package) - update to 4.5.3-4.el8ev
Data Replication on Cloud Pak for Data - update to 4.6.4
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.5
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC VxRail Appliance - update to 7.0.411
IBM supplied MQ Advanced container images - addressed in versions 9.3.0.4-r1, 9.3.2.0-r1
EMC Cloud Tiering Appliance - update to 13.2.0.2.22
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.3, 23.0.3

• https://dev.gnupg.org/T6284
• https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070
• https://www.debian.org/security/2022/dsa-5305

• Integer overflow in Libksba
• Debian update for libksba
• Slackware Linux update for libksba
• Gentoo update for libksba
• SUSE update for libksba
• SUSE update for libksba
• Ubuntu update for libksba
• Ubuntu update for libksba
• Red Hat Enterprise Linux 7 update for libksba
• Red Hat Enterprise Linux 8.6 Extended Update Support update for libksba
• Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions update for libksba
• Red Hat Enterprise Linux 9.0 Extended Update Support update for libksba
• Red Hat Enterprise Linux 9 update for libksba
• Red Hat Enterprise Linux 8 update for libksba
• Red Hat Enterprise Linux 8.4 Extended Update Support update for libksba
• SUSE update for libksba
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• OpenShift Container Platform 4.11 update for Golang
• SUSE update for libksba
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Multiple vulnerabilities in NetObserv Operator
• Multiple vulnerabilities in JBoss EAP XP
• CentOS 7 update for libksba
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 update for redhat-release-virtualization-host and redhat-virtualization-host
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• OpenShift Container Platform 4.12 update for goutils
• Multiple vulnerabilities in Red Hat build of Cryostat on RHEL 8
• Multiple vulnerabilities in Red Hat OpenShift GitOps
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in IBM MQ Operator and Queue Manager container images
• Multiple vulnerabilities in OpenShift Developer Tools and Services
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in Red Hat OpenStack Platform 16.2
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.1
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.12
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• VMware Tanzu Operations Manager update for Libksba
• Tanzu Greenplum for Kubernetes update for Libksba
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Configuration Console
• Integer overflow in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Data Science 1.22
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in Secondary Scheduler Operator for Red Hat OpenShift
• Amazon Linux AMI update for libksba
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Migration Toolkit for Containers (MTC) 1.7 update for golang
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.11
• Multiple vulnerabilities in OpenShift Developer Tools and Services 4.12
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Integer overflow in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Dell Container Storage Modules
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell ECS
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Multiple vulnerabilities in Service Telemetry Framework 1.5
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• Multiple vulnerabilities in Red Hat Self Node Remediation Operator 0.5
• Multiple vulnerabilities in Red Hat Node Maintenance Operator 5.0
• Multiple vulnerabilities in Node Health Check Operator 0.4
• Multiple vulnerabilities in Migration Toolkit for Virtualization 2.4
• IBM Data Replication on Cloud Pak for Data update for Libksba
• openEuler 20.03 LTS SP3 update for libksba
• openEuler 20.03 LTS SP1 update for libksba
• openEuler 22.03 LTS update for libksba
• openEuler 22.03 LTS SP1 update for libksba
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Red Hat Enterprise Linux 8 update for libksba
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Anolis OS update for libksba
• Anolis OS update for libksba
• Multiple vulnerabilities in IBM Edge Application Manager