CVE-2022-30295 Other in n/a

What is CVE-2022-30295?

CVE-2022-30295 is a medium-severity vulnerability in n/a, published on 6 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.

Weakness: CWE-330

Which versions are affected by CVE-2022-30295?

It affects 2 products.

Products include Uclibc-Ng Project Uclibc-Ng, Uclibc Uclibc.

How do I fix CVE-2022-30295?

Upgrade to a fixed version.

Is CVE-2022-30295 being exploited?

There is no known exploitation of CVE-2022-30295 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-43523 Cross-site scripting in n/a Critical 9.6
• CVE-2016-2224 Denial of service in n/a High 7.5
• CVE-2016-2225 Denial of service in n/a High 7.5
• CVE-2016-6264 Integer overflow in n/a High 7.5
• CVE-2021-27419 uClibc-ng Integer Overflow or Wraparound High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-9702, DEBIAN-CVE-2022-30295, GHSA-gv7v-mf7r-p93f.