Infinite loop in file-type - CVE-2022-36313
Published: February 9, 2023
Vulnerability identifier: #VU72101
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-36313
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when handling MKV files. A remote attacker can pass a specially crafted MKV file to the application, consume all available system resources and cause denial of service conditions.
Affected software
file-type
QRadar Suite
IBM Cloud Pak for Multicloud Management
JBoss Data Grid
IBM App Connect Enterprise
QRadar Suite
IBM Cloud Pak for Multicloud Management
JBoss Data Grid
IBM App Connect Enterprise
How to mitigate CVE-2022-36313
Install updates from vendor's website.
file-type - addressed in versions 16.5.4, 17.1.3
QRadar Suite - update to 1.10.17.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
JBoss Data Grid - update to 8.4.1
QRadar Suite - update to 1.10.17.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
JBoss Data Grid - update to 8.4.1