CVE-2022-40468
tinyproxy-bin: Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used
CVE-2022-40468 is fixed in 2 products on 1 platform, first by tinyproxy 1.8.4-5ubuntu0.1~esm2, released September 19, 2022. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0190
79th percentile
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| tinyproxy · Debian 11.6 (bullseye) | 1.10.0-5+deb11u1 | DLA-3892-1 | Sep 18, 2024 |
| tinyproxy · Debian 12.15 (bookworm) | 1.11.1-2 | DEBIAN-CVE-2022-40468 | Sep 19, 2022 |
| tinyproxy · Debian 13.5 (trixie) | 1.11.1-2 | DEBIAN-CVE-2022-40468 | Sep 19, 2022 |
| tinyproxy · Debian 14 | 1.11.1-2 | DEBIAN-CVE-2022-40468 | Sep 19, 2022 |
| tinyproxy · Ubuntu 18.04.6 LTS (bionic) | 1.8.4-5ubuntu0.1~esm2 | tinyproxy 1.8.4-5ubuntu0.1~esm2 | Sep 19, 2022 |
| tinyproxy · Ubuntu 20.04 LTS (focal) | 1.10.0-4ubuntu0.1 | tinyproxy 1.10.0-4ubuntu0.1 | Sep 19, 2022 |
| tinyproxy · Ubuntu 22.04.1 LTS (jammy) | 1.11.0-1ubuntu0.1~esm1 | tinyproxy 1.11.0-1ubuntu0.1~esm1 | Sep 19, 2022 |
| tinyproxy-bin · Ubuntu 18.04.6 LTS (bionic) | 1.8.4-5ubuntu0.1~esm2 | tinyproxy-bin 1.8.4-5ubuntu0.1~esm2 | Sep 19, 2022 |
| tinyproxy-bin · Ubuntu 20.04 LTS (focal) | 1.10.0-4ubuntu0.1 | tinyproxy-bin 1.10.0-4ubuntu0.1 | Sep 19, 2022 |
| tinyproxy-bin · Ubuntu 22.04.1 LTS (jammy) | 1.11.0-1ubuntu0.1~esm1 | tinyproxy-bin 1.11.0-1ubuntu0.1~esm1 | Sep 19, 2022 |