CVE-2022-20785 ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022

High 7.5 Published 4 May 2022 Updated 6 Nov 2024

A memory leak in the ClamAV HTML parser allows remote attackers to cause a denial of service on affected systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-20785?

CVE-2022-20785 is a high-severity denial of service vulnerability in Clamav Clamav, published on 4 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. For a description of this vulnerability, see the ClamAV blog. This advisory will be updated as additional information becomes available.

Weakness: CWE-401

Which versions are affected by CVE-2022-20785?

It affects 4 products.

Products include Cisco Secure Endpoint, Clamav Clamav, Debian Debian Linux, Fedoraproject Fedora.

How do I fix CVE-2022-20785?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-20785 being exploited?

There is no known exploitation of CVE-2022-20785 in the wild and no public exploit code.

All Clamav Clamav vulnerabilities

Sources

Also known as ALPINE-CVE-2022-20785, DEBIAN-CVE-2022-20785, GHSA-mhgp-p5ch-58q3, UBUNTU-CVE-2022-20785.