VDB
CVE-2022-1117
CVE-2022-1117
PUBLISHED
CVSS 8.399999618530273 HIGH
A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution.
EPSS 0.33% · 26.0th percentile
Risk Scores
CVSS 3.1
8.399999618530273
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.33%
26.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| fapolicyd_project | fapolicyd | 0 |
| n/a | fapolicyd | Fixed in v1.1.2 |
Timeline
- May 10, 2022 CVE Published
- Aug 30, 2022 EPSS Score
- Oct 15, 2022 EPSS Score
- Dec 1, 2022 EPSS Score
- Jan 16, 2023 EPSS Score
- Mar 3, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 18, 2023 EPSS Score
- Jun 4, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
- Sep 4, 2023 EPSS Score
- Oct 20, 2023 EPSS Score
References
- https://access.redhat.com/security/cve/CVE-2022-1117 advisory
- https://github.com/linux-application-whitelisting/fapolicyd/commit/38a942613f93824c53164730b2b7a2f75b8cd263 fix
- https://bugzilla.redhat.com/show_bug.cgi?id=2068171 url
- https://bugzilla.redhat.com/show_bug.cgi?id=2066904 url
- https://nvd.nist.gov/vuln/detail/CVE-2022-1117 advisory
- https://access.redhat.com/errata/RHSA-2022:1898 advisory
- https://access.redhat.com/errata/RHSA-2022:4824 advisory