<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2022-22995</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2022-22995</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>11</Number>
        <Date>2025-02-16T03:11:53Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-04-03T02:00:54Z</InitialReleaseDate>
    <CurrentReleaseDate>2025-02-16T03:11:53Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2022-22995</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2023-October/016694.html</URL>
      <Description>E-Mail link for SUSE-SU-2023:4084-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Workstation Extension 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5" CPE="cpe:/o:suse:sle-we:12:sp5">SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Workstation Extension 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5" CPE="cpe:/o:suse:sle-we:12:sp5">SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libatalk12-3.1.0-3.22.1">
      <FullProductName ProductID="libatalk12-3.1.0-3.22.1">libatalk12-3.1.0-3.22.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="netatalk-3.1.0-3.22.1">
      <FullProductName ProductID="netatalk-3.1.0-3.22.1" CPE="cpe:2.3:a:netatalk:netatalk:3.1.0:*:*:*:*:*:*:*">netatalk-3.1.0-3.22.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="netatalk-devel-3.1.0-3.22.1">
      <FullProductName ProductID="netatalk-devel-3.1.0-3.22.1">netatalk-devel-3.1.0-3.22.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libatalk12-3.1.0-3.22.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libatalk12-3.1.0-3.22.1">libatalk12-3.1.0-3.22.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="netatalk-3.1.0-3.22.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:netatalk-3.1.0-3.22.1">netatalk-3.1.0-3.22.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="netatalk-devel-3.1.0-3.22.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:netatalk-devel-3.1.0-3.22.1">netatalk-devel-3.1.0-3.22.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="libatalk12-3.1.0-3.22.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:libatalk12-3.1.0-3.22.1">libatalk12-3.1.0-3.22.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="netatalk-3.1.0-3.22.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Workstation Extension 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Workstation Extension 12 SP5:netatalk-3.1.0-3.22.1">netatalk-3.1.0-3.22.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.</Note>
    </Notes>
    <CVE>CVE-2022-22995</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libatalk12-3.1.0-3.22.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:netatalk-3.1.0-3.22.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:netatalk-devel-3.1.0-3.22.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:libatalk12-3.1.0-3.22.1</ProductID>
        <ProductID>SUSE Linux Enterprise Workstation Extension 12 SP5:netatalk-3.1.0-3.22.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
