CVE-2022-43285 Memory corruption in n/a
A segmentation violation in the NJS library can cause a denial of service, though the vendor disputes its security significance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43285?
CVE-2022-43285 is a high-severity memory corruption vulnerability in n/a, published on 28 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disputes the significance of this report because NJS does not operate on untrusted input.
Weakness: CWE-787
Which versions are affected by CVE-2022-43285?
It affects 1 product.
Products include F5 Njs.
How do I fix CVE-2022-43285?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-43285 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-43285 exists.
Other vulnerabilities in n/a
Sources
Also known as BELL-CVE-2022-43285, GHSA-fgh9-wfj4-j5gv.