CVE-2022-37797
Fixed in a distro release EPSS 3%
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition.
Products: lighttpd, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | lighttpd | 1.4.67-1 |
| Debian 10 | lighttpd | 1.4.53-4+deb10u3 |
| Debian 11 | lighttpd | 1.4.59-1+deb11u2 |
| Debian 12 | lighttpd | 1.4.66-1 |
| Debian 13 | lighttpd | 1.4.66-1 |
| Debian 14 | lighttpd | 1.4.66-1 |
| SUSE Package Hub 15 SP3 | lighttpd | 1.4.66-bp154.2.3.1 |
| SUSE Package Hub 15 SP4 | lighttpd | 1.4.66-bp154.2.3.1 |
| Ubuntu 20.04 LTS | lighttpd | no fix |
| Ubuntu 22.04 LTS | lighttpd | no fix |
| openSUSE Leap 15.3 | lighttpd | 1.4.66-bp154.2.3.1 |
| openSUSE Leap 15.4 | lighttpd | 1.4.66-bp154.2.3.1 |
| openSUSE Tumbleweed | lighttpd | 1.4.66-1.1 |