Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-4066: davidmoreno onion Log response.c onion_response_flush allocation of resources

CVE-2022-4066 · published 3 years ago

Summary

A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/onion/response.c of the component Log Handler. The manipulation leads to allocation of resources. The name of the patch is de8ea938342b36c2802...

What to do

Update onion_project onion to version 2022-09-05 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	All versions `cpe:2.3:a:mozilla:firefox:-:::::::*`
onion_project	onion	< 2022-09-05 `cpe:2.3:a:onion_project:onion::::::::`

Original advisory text

davidmoreno onion Log response.c onion_response_flush allocation of resources

References

https://vuldb.com/?id.214028 URL
https://github.com/davidmoreno/onion/commit/de8ea938342b36c28024fd8393ebc27b8442... Patch
https://github.com/davidmoreno/onion/pull/308 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4066.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4066 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.5 Low

Exploitation

1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

Timeline

Published19 Nov 2022

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2022-4066 · NVD

CVE-2022-4066 · OSV

Track software like this

Free during beta