CVE-2022-28658

Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://ubuntu.com/security/notices/USN-5427-1	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2022-28658	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:18.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:21.10::::-:::
	cpe:2.3:o:canonical:ubuntu_linux:22.04::::lts:::

History

11 Jun 2024, 16:56

Type	Values Removed	Values Added
CPE		cpe:2.3:o:canonical:ubuntu_linux:22.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:20.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:18.04::::esm::: cpe:2.3:a:apport_project:apport:::::::: cpe:2.3:o:canonical:ubuntu_linux:21.10::::-:::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
References	~~() https://ubuntu.com/security/notices/USN-5427-1 -~~	() https://ubuntu.com/security/notices/USN-5427-1 - Third Party Advisory
References	~~() https://www.cve.org/CVERecord?id=CVE-2022-28658 -~~	() https://www.cve.org/CVERecord?id=CVE-2022-28658 - Third Party Advisory
First Time		Apport Project Apport Project apport Canonical ubuntu Linux Canonical
CWE		NVD-CWE-noinfo

05 Jun 2024, 12:53

Type	Values Removed	Values Added
Summary		(es) El análisis de argumentos de Apport maneja mal la división de nombres de archivos en núcleos más antiguos, lo que resulta en suplantación de argumentos

04 Jun 2024, 22:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-04 22:15

Updated : 2024-10-27 15:35

NVD link : CVE-2022-28658

Mitre link : CVE-2022-28658

CVE.ORG link : CVE-2022-28658

JSON object : View

Products Affected

apport_project

apport

canonical

ubuntu_linux

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-28658", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-06-04T22:15:10.153", "references": [{"url": "https://ubuntu.com/security/notices/USN-5427-1", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2022-28658", "tags": ["Third Party Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing"}, {"lang": "es", "value": "El an\u00e1lisis de argumentos de Apport maneja mal la divisi\u00f3n de nombres de archivos en n\u00facleos m\u00e1s antiguos, lo que resulta en suplantaci\u00f3n de argumentos"}], "lastModified": "2024-10-27T15:35:01.733", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD92D087-0439-48BE-9B32-5156B335A145", "versionEndExcluding": "2.21.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "B3293E55-5506-4587-A318-D1734F781C09"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "902B8056-9E37-443B-8905-8AA93E2447FB"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:21.10:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "3D94DA3B-FA74-4526-A0A0-A872684598C6"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "359012F1-2C63-415A-88B8-6726A87830DE"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}