CVE-2022-20770 ClamAV CHM File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022

High 8.6 Published 4 May 2022 Updated 6 Nov 2024

Remote attackers can cause a denial of service in ClamAV via malicious CHM files, affecting Cisco AMP for Endpoints and other systems using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-20770?

CVE-2022-20770 is a high-severity denial of service vulnerability in Clamav Clamav, published on 4 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Weakness: CWE-399

Which versions are affected by CVE-2022-20770?

It affects 4 products.

Products include Cisco Secure Endpoint, Clamav Clamav, Debian Debian Linux, Fedoraproject Fedora.

How do I fix CVE-2022-20770?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-20770 being exploited?

There is no known exploitation of CVE-2022-20770 in the wild and no public exploit code.

All Clamav Clamav vulnerabilities

Sources

Also known as ALPINE-CVE-2022-20770, AZL-9666, DEBIAN-CVE-2022-20770, GHSA-5443-gj53-cw56, UBUNTU-CVE-2022-20770.