CVE-2022-37797 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-37797 Interim 1 9 2025-02-16T02:56:14Z current 2022-09-13T23:32:44Z 2025-02-16T02:56:14Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-37797 In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ATUOJQDWIRALBMVI5GOSOGPZP5AWVAZF/ E-Mail link for openSUSE-SU-2022:10132-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise High Availability Extension 12 SP4 SUSE Linux Enterprise High Availability Extension 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Package Hub 15 SP3 SUSE Package Hub 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed lighttpd lighttpd-1.4.66-1.1 lighttpd-1.4.66-bp153.2.9.1 lighttpd-1.4.66-bp154.2.3.1 lighttpd-mod_authn_gssapi-1.4.66-1.1 lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 lighttpd-mod_authn_ldap-1.4.66-1.1 lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 lighttpd-mod_authn_pam-1.4.66-1.1 lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 lighttpd-mod_authn_sasl-1.4.66-1.1 lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 lighttpd-mod_magnet-1.4.66-1.1 lighttpd-mod_magnet-1.4.66-bp153.2.9.1 lighttpd-mod_magnet-1.4.66-bp154.2.3.1 lighttpd-mod_maxminddb-1.4.66-1.1 lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 lighttpd-mod_rrdtool-1.4.66-1.1 lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_dbi-1.4.66-1.1 lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_ldap-1.4.66-1.1 lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_mysql-1.4.66-1.1 lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 lighttpd-mod_vhostdb_pgsql-1.4.66-1.1 lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 lighttpd-mod_webdav-1.4.66-1.1 lighttpd-mod_webdav-1.4.66-bp153.2.9.1 lighttpd-mod_webdav-1.4.66-bp154.2.3.1 lighttpd-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_magnet-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-mod_webdav-1.4.66-bp153.2.9.1 as a component of SUSE Package Hub 15 SP3 lighttpd-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_magnet-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-mod_webdav-1.4.66-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 lighttpd-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_magnet-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-mod_webdav-1.4.66-bp153.2.9.1 as a component of openSUSE Leap 15.3 lighttpd-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_magnet-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-mod_webdav-1.4.66-bp154.2.3.1 as a component of openSUSE Leap 15.4 lighttpd-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_authn_gssapi-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_authn_ldap-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_authn_pam-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_authn_sasl-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_magnet-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_maxminddb-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_rrdtool-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_vhostdb_dbi-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_vhostdb_ldap-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_vhostdb_mysql-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_vhostdb_pgsql-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd-mod_webdav-1.4.66-1.1 as a component of openSUSE Tumbleweed lighttpd as a component of SUSE Linux Enterprise High Availability Extension 12 SP4 lighttpd as a component of SUSE Linux Enterprise High Availability Extension 12 SP5 lighttpd as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 lighttpd as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null pointer dereference which crashes the server. It could be used by an external attacker to cause denial of service condition. CVE-2022-37797 SUSE Package Hub 15 SP3:lighttpd-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_magnet-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP3:lighttpd-mod_webdav-1.4.66-bp153.2.9.1 SUSE Package Hub 15 SP4:lighttpd-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_magnet-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 SUSE Package Hub 15 SP4:lighttpd-mod_webdav-1.4.66-bp154.2.3.1 openSUSE Leap 15.3:lighttpd-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_authn_gssapi-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_authn_ldap-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_authn_pam-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_authn_sasl-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_magnet-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_maxminddb-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_rrdtool-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_vhostdb_dbi-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_vhostdb_ldap-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_vhostdb_mysql-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_vhostdb_pgsql-1.4.66-bp153.2.9.1 openSUSE Leap 15.3:lighttpd-mod_webdav-1.4.66-bp153.2.9.1 openSUSE Leap 15.4:lighttpd-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_authn_gssapi-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_authn_ldap-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_authn_pam-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_authn_sasl-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_magnet-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_maxminddb-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_rrdtool-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_vhostdb_dbi-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_vhostdb_ldap-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_vhostdb_mysql-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_vhostdb_pgsql-1.4.66-bp154.2.3.1 openSUSE Leap 15.4:lighttpd-mod_webdav-1.4.66-bp154.2.3.1 openSUSE Tumbleweed:lighttpd-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_authn_gssapi-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_authn_ldap-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_authn_pam-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_authn_sasl-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_magnet-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_maxminddb-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_rrdtool-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_vhostdb_dbi-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_vhostdb_ldap-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_vhostdb_mysql-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_vhostdb_pgsql-1.4.66-1.1 openSUSE Tumbleweed:lighttpd-mod_webdav-1.4.66-1.1 SUSE Linux Enterprise High Availability Extension 12 SP4:lighttpd SUSE Linux Enterprise High Availability Extension 12 SP5:lighttpd SUSE Linux Enterprise Server for SAP Applications 12 SP4:lighttpd SUSE Linux Enterprise Server for SAP Applications 12 SP5:lighttpd important 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H