CVE-2022-20698
Clam AntiVirus (ClamAV) Denial of Service Vulnerability
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 3.06 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Modified
Description
A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | cisco |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · psirt@cisco.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-25948
- GCVE · GCVE-0-2022-20698
CERT-FR advisories
- CERTFR-2022-AVI-330 — Multiples vulnérabilités dans Stormshield Network Security · cert.ssi.gouv.fr
- CERTFR-2022-AVI-036 — Vulnérabilité dans ClamAV · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:clamav:clamav:*:*:*:*:lts:*:*:*< 0.103.5cpe:2.3:a:clamav:clamav:*:*:*:*:*:*:*:*≥ 0.104.0 < 0.104.2cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:20.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:21.04:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Cisco · ClamAV | affected unspecified < 0.103.5 |
| Cisco · ClamAV | affected unspecified < 0.104.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |