CVE-2022-37434 (High) detected in zlibv1.2.11

[mend-bolt-for-github]

CVE-2022-37434 - High Severity Vulnerability

Vulnerable Library - zlibv1.2.11

A massively spiffy yet delicately unobtrusive compression library.

Library home page: https://github.com/madler/zlib.git

Found in HEAD commit: f982a2ac7e2b2fffce4b4bc02af9d8eebfaf953b

Vulnerable Source Files (2)

/node_modules/grpc/deps/grpc/third_party/zlib/inflate.c
/node_modules/grpc/deps/grpc/third_party/zlib/inflate.c

Vulnerability Details

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

Publish Date: 2022-08-05

URL: CVE-2022-37434

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with Mend here