Vulnerability-Lookup

CVE-2022-40468 (GCVE-0-2022-40468)

Vulnerability from cvelistv5 – Published: 2022-09-19 00:00 – Updated: 2025-11-04 16:09

Summary

Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://github.com/tinyproxy/tinyproxy
https://github.com/tinyproxy/tinyproxy/blob/84f20…
https://github.com/tinyproxy/tinyproxy/issues/457
https://github.com/tinyproxy/tinyproxy/issues/457…
https://security.gentoo.org/glsa/202305-27	vendor-advisory
https://lists.debian.org/debian-lts-announce/2024…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T16:09:53.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/tinyproxy/tinyproxy"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
          },
          {
            "name": "GLSA-202305-27",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-27"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-21T00:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/tinyproxy/tinyproxy"
        },
        {
          "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
        },
        {
          "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
        },
        {
          "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
        },
        {
          "name": "GLSA-202305-27",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-27"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-40468",
    "datePublished": "2022-09-19T00:00:00.000Z",
    "dateReserved": "2022-09-11T00:00:00.000Z",
    "dateUpdated": "2025-11-04T16:09:53.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-40468",
      "date": "2026-09-16",
      "epss": "0.01869",
      "percentile": "0.78268"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.11.1\", \"matchCriteriaId\": \"3E51FD82-DAE3-49BD-A817-91A131CE6525\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.\"}, {\"lang\": \"es\", \"value\": \"Posible fuga de datos sobrantes de la pila si se utilizan plantillas de p\\u00e1ginas de error personalizadas que contienen variables especiales no est\\u00e1ndar. El commit 84f203f de Tinyproxy y los anteriores utilizan b\\u00faferes no inicializados en la funci\\u00f3n process_request()\"}]",
      "id": "CVE-2022-40468",
      "lastModified": "2024-11-21T07:21:25.437",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2022-09-19T17:15:14.700",
      "references": "[{\"url\": \"https://github.com/tinyproxy/tinyproxy\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/tinyproxy/tinyproxy/issues/457\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://security.gentoo.org/glsa/202305-27\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://github.com/tinyproxy/tinyproxy\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/tinyproxy/tinyproxy/issues/457\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202305-27\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-1188\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-40468\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-09-19T17:15:14.700\",\"lastModified\":\"2026-06-17T05:01:25.110\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.\"},{\"lang\":\"es\",\"value\":\"Posible fuga de datos sobrantes de la pila si se utilizan plantillas de p\u00e1ginas de error personalizadas que contienen variables especiales no est\u00e1ndar. El commit 84f203f de Tinyproxy y los anteriores utilizan b\u00faferes no inicializados en la funci\u00f3n process_request()\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1188\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.11.1\",\"matchCriteriaId\":\"3E51FD82-DAE3-49BD-A817-91A131CE6525\"}]}]}],\"references\":[{\"url\":\"https://github.com/tinyproxy/tinyproxy\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/tinyproxy/tinyproxy/issues/457\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/202305-27\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/tinyproxy/tinyproxy\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/tinyproxy/tinyproxy/issues/457\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202305-27\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-29T01:33:21+00:00",
      "cve": "CVE-2022-40468",
      "id": "CVE-2022-40468",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2022-40468",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-40468.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2025-03-15T07:23:07Z",
      "cve": "CVE-2022-40468",
      "id": "CVE-2022-40468",
      "initial_release_date": "2023-02-15T03:23:37Z",
      "product_status:recommended": "3",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-40468",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-40468.json",
      "version": "7"
    }
  }
}

FKIE_CVE-2022-40468

Vulnerability from fkie_nvd - Published: 2022-09-19 17:15 - Updated: 2026-06-17 05:01

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
cve@mitre.org	https://github.com/tinyproxy/tinyproxy	Third Party Advisory
cve@mitre.org	https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346	Exploit, Third Party Advisory
cve@mitre.org	https://github.com/tinyproxy/tinyproxy/issues/457	Exploit, Third Party Advisory
cve@mitre.org	https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815
cve@mitre.org	https://security.gentoo.org/glsa/202305-27
af854a3a-2127-422b-91ae-364da2661108	https://github.com/tinyproxy/tinyproxy	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/tinyproxy/tinyproxy/issues/457	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/202305-27

Impacted products

	Vendor	Product	Version
	tinyproxy_project	tinyproxy	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E51FD82-DAE3-49BD-A817-91A131CE6525",
              "versionEndIncluding": "1.11.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function."
    },
    {
      "lang": "es",
      "value": "Posible fuga de datos sobrantes de la pila si se utilizan plantillas de p\u00e1ginas de error personalizadas que contienen variables especiales no est\u00e1ndar. El commit 84f203f de Tinyproxy y los anteriores utilizan b\u00faferes no inicializados en la funci\u00f3n process_request()"
    }
  ],
  "id": "CVE-2022-40468",
  "lastModified": "2026-06-17T05:01:25.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-09-19T17:15:14.700",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinyproxy/tinyproxy"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://security.gentoo.org/glsa/202305-27"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinyproxy/tinyproxy"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/202305-27"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-H3R7-X4MP-2C39

Vulnerability from github – Published: 2022-09-20 00:00 – Updated: 2025-11-04 18:30

Details

Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request() function and is using uninitialized buffers. This vulnerability allows attackers to access sensitive information at system runtime.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-40468"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-19T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request() function and is using uninitialized buffers. This vulnerability allows attackers to access sensitive information at system runtime.",
  "id": "GHSA-h3r7-x4mp-2c39",
  "modified": "2025-11-04T18:30:39Z",
  "published": "2022-09-20T00:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40468"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00035.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-40468

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-40468

Aliases

CVE-2022-40468

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-40468",
    "description": "Tinyproxy commit 84f203f and earlier does not process HTTP request lines in the process_request() function and is using uninitialized buffers. This vulnerability allows attackers to access sensitive information at system runtime.",
    "id": "GSD-2022-40468",
    "references": [
      "https://www.suse.com/security/cve/CVE-2022-40468.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-40468"
      ],
      "details": "Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.",
      "id": "GSD-2022-40468",
      "modified": "2023-12-13T01:19:30.222515Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2022-40468",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/tinyproxy/tinyproxy",
            "refsource": "MISC",
            "url": "https://github.com/tinyproxy/tinyproxy"
          },
          {
            "name": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346",
            "refsource": "MISC",
            "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
          },
          {
            "name": "https://github.com/tinyproxy/tinyproxy/issues/457",
            "refsource": "MISC",
            "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
          },
          {
            "name": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815",
            "refsource": "MISC",
            "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
          },
          {
            "name": "GLSA-202305-27",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/202305-27"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:tinyproxy_project:tinyproxy:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.11.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2022-40468"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-1188"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/tinyproxy/tinyproxy",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/tinyproxy/tinyproxy"
            },
            {
              "name": "https://github.com/tinyproxy/tinyproxy/issues/457",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
            },
            {
              "name": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
            },
            {
              "name": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815",
              "refsource": "MISC",
              "tags": [],
              "url": "https://github.com/tinyproxy/tinyproxy/issues/457#issuecomment-1264176815"
            },
            {
              "name": "GLSA-202305-27",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/202305-27"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2023-05-21T22:15Z",
      "publishedDate": "2022-09-19T17:15Z"
    }
  }
}

OPENSUSE-SU-2024:0119-1

Vulnerability from csaf_opensuse - Published: 2024-05-10 12:42 - Updated: 2024-05-10 12:42

Summary

Security update for tinyproxy

Severity

Important

Scope

5 vulnerabilities in this advisory, including CVE-2022-40468.

CVE-2022-40468

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Recommended: 10 products

Open the full advisory

OPENSUSE-SU-2024:12351-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

tinyproxy-1.11.1-2.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2022-40468.

CVE-2022-40468

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Recommended: 4 products

Open the full advisory

ubuntu-cve-2022-40468

Vulnerability from osv_ubuntu

Published

2022-09-19 17:15

Modified

2025-10-24 04:53

Summary

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-40468	REPORT
	https://github.com/tinyproxy/tinyproxy/issues/457	REPORT
	https://github.com/tinyproxy/tinyproxy/commit/376…	REPORT
	https://github.com/tinyproxy/tinyproxy	REPORT
	https://github.com/tinyproxy/tinyproxy/blob/84f20…	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-40468	REPORT
	https://ubuntu.com/security/notices/USN-7140-1	ADVISORY
	https://ubuntu.com/security/notices/USN-7140-2	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "tinyproxy",
            "binary_version": "1.8.3-3ubuntu14.04.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "tinyproxy",
        "purl": "pkg:deb/ubuntu/tinyproxy@1.8.3-3ubuntu14.04.1~esm2?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.3-3ubuntu14.04.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3ubuntu1",
        "1.8.3-3ubuntu14.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "tinyproxy",
            "binary_version": "1.8.3-3ubuntu16.04.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "tinyproxy",
        "purl": "pkg:deb/ubuntu/tinyproxy@1.8.3-3ubuntu16.04.1~esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.3-3ubuntu16.04.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.3-3ubuntu1",
        "1.8.3-3ubuntu16.04.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "tinyproxy",
            "binary_version": "1.8.4-5ubuntu0.1~esm2"
          },
          {
            "binary_name": "tinyproxy-bin",
            "binary_version": "1.8.4-5ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "tinyproxy",
        "purl": "pkg:deb/ubuntu/tinyproxy@1.8.4-5ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.4-5ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.4-2",
        "1.8.4-3",
        "1.8.4-5",
        "1.8.4-5ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "tinyproxy",
            "binary_version": "1.10.0-4ubuntu0.1"
          },
          {
            "binary_name": "tinyproxy-bin",
            "binary_version": "1.10.0-4ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "tinyproxy",
        "purl": "pkg:deb/ubuntu/tinyproxy@1.10.0-4ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.10.0-4ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.0-2",
        "1.10.0-4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "tinyproxy",
            "binary_version": "1.11.0-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "tinyproxy-bin",
            "binary_version": "1.11.0-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "tinyproxy",
        "purl": "pkg:deb/ubuntu/tinyproxy@1.11.0-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.0-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.10.0-5",
        "1.11.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.",
  "id": "UBUNTU-CVE-2022-40468",
  "modified": "2025-10-24T04:53:51Z",
  "published": "2022-09-19T17:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-40468"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tinyproxy/tinyproxy/issues/457"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tinyproxy/tinyproxy/commit/3764b8551463b900b5b4e3ec0cd9bb9182191cb7"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tinyproxy/tinyproxy"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/tinyproxy/tinyproxy/blob/84f203fb1c4733608c7283bbe794005a469c4b00/src/reqs.c#L346"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-40468"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7140-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7140-2"
    }
  ],
  "related": [
    "USN-7140-1",
    "USN-7140-2"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-40468"
  ]
}

WID-SEC-W-2024-0556

Vulnerability from csaf_certbund - Published: 2024-03-05 23:00 - Updated: 2024-12-08 23:00

Summary

Sophos Unified Threat Management (UTM) Software: Mehrere Schwachstellen

Severity

Mittel

Scope

4 vulnerabilities in this advisory, including CVE-2022-40468.

CVE-2022-40468

Es bestehen mehrere Schwachstellen in der Sophos Unified Threat Management (UTM) Software. Diese Fehler bestehen unter anderem in den Komponenten "curl", "OpenVPN" und "Tinyproxy". Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um vertrauliche Informationen offenzulegen, einen Denial of Service zu verursachen Dateien zu manipulieren oder weitere, unbekannte Auswirkungen zu verursachen.

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-40468 (GCVE-0-2022-40468)

FKIE_CVE-2022-40468

GHSA-H3R7-X4MP-2C39

GSD-2022-40468

OPENSUSE-SU-2024:0119-1

OPENSUSE-SU-2024:12351-1

ubuntu-cve-2022-40468

Vulnerability from osv_ubuntu

WID-SEC-W-2024-0556

Tags

Sightings

Nomenclature

Related by attack behaviour