CVE-2022-28652

~/.config/apport/settings parsing is vulnerable to "billion laughs" attack

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://ubuntu.com/security/notices/USN-5427-1	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-28652	Third Party Advisory
https://ubuntu.com/security/notices/USN-5427-1	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-28652	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:18.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:21.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:22.04::::lts:::

History

21 Nov 2024, 06:57

Type	Values Removed	Values Added
References	~~() https://ubuntu.com/security/notices/USN-5427-1 - Third Party Advisory~~	() https://ubuntu.com/security/notices/USN-5427-1 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2022-28652 - Third Party Advisory~~	() https://www.cve.org/CVERecord?id=CVE-2022-28652 - Third Party Advisory

11 Jun 2024, 17:05

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
First Time		Apport Project apport Canonical ubuntu Linux Canonical Apport Project
CWE		CWE-776
References	~~() https://ubuntu.com/security/notices/USN-5427-1 -~~	() https://ubuntu.com/security/notices/USN-5427-1 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2022-28652 -~~	() https://www.cve.org/CVERecord?id=CVE-2022-28652 - Third Party Advisory
CPE		cpe:2.3:a:apport_project:apport:::::::: cpe:2.3:o:canonical:ubuntu_linux:18.04::::esm::: cpe:2.3:o:canonical:ubuntu_linux:21.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:22.04::::lts:::

05 Jun 2024, 12:53

Type	Values Removed	Values Added
Summary		(es) ~/.config/apport/settings el análisis es vulnerable al ataque de "billion laughs"

04 Jun 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-04 22:15

Updated : 2024-11-21 06:57

NVD link : CVE-2022-28652

Mitre link : CVE-2022-28652

CVE.ORG link : CVE-2022-28652

JSON object : View

Products Affected

canonical

ubuntu_linux

apport_project

apport

CWE

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

5.5 /10