A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Facebook
  • Zstandard
Redhat
  • Amq Streams
  • Enterprise Linux
  • Rhel Software Collections

Configuration 1 [-]

cpe:2.3:a:facebook:zstandard:1.4.10:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat AMQ Streams 2.7.0
cpe:/a:redhat:amq_streams:2 RHSA-2024:3527 2024-05-30T00:00:00Z
Red Hat Enterprise Linux 8
mysql:8.0-8090020240126173013.a75119d5 cpe:/a:redhat:enterprise_linux:8 RHSA-2024:0894 2024-02-20T00:00:00Z
Red Hat Enterprise Linux 9
mysql-0:8.0.36-1.el9_3 cpe:/a:redhat:enterprise_linux:9 RHSA-2024:1141 2024-03-05T00:00:00Z
Red Hat Software Collections for Red Hat Enterprise Linux 7
rh-mysql80-mysql-0:8.0.36-1.el7 cpe:/a:redhat:rhel_software_collections:3::el7 RHSA-2024:2619 2024-04-30T00:00:00Z
References
Link Providers
https://github.com/facebook/zstd/issues/3200 cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-4899 cve-icon
https://security.netapp.com/advisory/ntap-20230725-0005/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-4899 cve-icon
History

Tue, 18 Feb 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2025-02-18T17:23:22.964Z

Reserved: 2023-01-31T00:00:00.000Z

Link: CVE-2022-4899

cve-icon Vulnrichment

Updated: 2024-08-03T01:55:46.209Z

cve-icon NVD

Status : Modified

Published: 2023-03-31T20:15:07.213

Modified: 2025-02-18T18:15:14.023

Link: CVE-2022-4899

cve-icon Redhat

Severity : Low

Publid Date: 2022-07-17T00:00:00Z

Links: CVE-2022-4899 - Bugzilla