CVE-2022-39278 (GCVE-0-2022-39278)

Vulnerability from cvelistv5 – Published: 2022-10-13 00:00 – Updated: 2025-04-23 16:50
VLAI?
Summary
Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.
Severity ?
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
Vendor Product Version
istio istio Affected: < 1.13.9
Affected: >= 1.14.0, < 1.14.5
Affected: >= 1.15.0, < 1.15.2
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:00:43.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39278",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:50:01.018220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:50:32.655Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "istio",
          "vendor": "istio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.14.0, \u003c 1.14.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.15.0, \u003c 1.15.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-13T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w"
        },
        {
          "url": "https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/"
        },
        {
          "url": "https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/"
        },
        {
          "url": "https://istio.io/news/releases/1.14.x/announcing-1.14.5/"
        }
      ],
      "source": {
        "advisory": "GHSA-86vr-4wcv-mm9w",
        "discovery": "UNKNOWN"
      },
      "title": "Istio vulnerable to denial of service attack due to Golang Regex Library"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39278",
    "datePublished": "2022-10-13T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:50:32.655Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"1.13.9\", \"matchCriteriaId\": \"29E9412C-C649-4DE8-98E6-4E1F48048156\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.14.0\", \"versionEndExcluding\": \"1.14.5\", \"matchCriteriaId\": \"A330CF8F-60D8-4C9A-94E2-4F9EA328D801\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.15.0\", \"versionEndExcluding\": \"1.15.2\", \"matchCriteriaId\": \"C0FE7223-1751-420F-AC19-7A6A98BC630C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.\"}, {\"lang\": \"es\", \"value\": \"Istio es una malla de servicios abierta e independiente de la plataforma que proporciona administraci\\u00f3n de tr\\u00e1fico, aplicaci\\u00f3n de pol\\u00edticas y recopilaci\\u00f3n de telemetr\\u00eda. En versiones anteriores a 1.15.2, 1.14.5, y 1.13.9, el plano de control de Istio, istiod, es vulnerable a un error de procesamiento de peticiones, permitiendo a un atacante malicioso que env\\u00ede un mensaje especialmente dise\\u00f1ado o de gran tama\\u00f1o que resulte en el bloqueo del plano de control cuando el servicio de webhooks de comprobaci\\u00f3n o mutaci\\u00f3n de Kubernetes est\\u00e1 expuesto p\\u00fablicamente. Este endpoint es servido a trav\\u00e9s del puerto 15017 de TLS, pero no requiere ninguna autenticaci\\u00f3n por parte del atacante. Para instalaciones sencillas, Istiod normalmente s\\u00f3lo es alcanzable desde dentro del cl\\u00faster, limitando el radio de explosi\\u00f3n. Sin embargo, para algunos despliegues, especialmente las topolog\\u00edas de istiod externas, este puerto est\\u00e1 expuesto a trav\\u00e9s de la Internet p\\u00fablica. Las versiones 1.15.2, 1.14.5 y 1.13.9 contienen parches para este problema. no se presentan mitigaciones efectivas, m\\u00e1s all\\u00e1 de la actualizaci\\u00f3n. Este bug es debido a un error en el archivo \\\"regexp.Compile\\\" en Go\"}]",
      "id": "CVE-2022-39278",
      "lastModified": "2024-11-21T07:17:56.580",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2022-10-13T23:15:11.033",
      "references": "[{\"url\": \"https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://istio.io/news/releases/1.14.x/announcing-1.14.5/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://istio.io/news/releases/1.14.x/announcing-1.14.5/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-39278\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-10-13T23:15:11.033\",\"lastModified\":\"2024-11-21T07:17:56.580\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.\"},{\"lang\":\"es\",\"value\":\"Istio es una malla de servicios abierta e independiente de la plataforma que proporciona administraci\u00f3n de tr\u00e1fico, aplicaci\u00f3n de pol\u00edticas y recopilaci\u00f3n de telemetr\u00eda. En versiones anteriores a 1.15.2, 1.14.5, y 1.13.9, el plano de control de Istio, istiod, es vulnerable a un error de procesamiento de peticiones, permitiendo a un atacante malicioso que env\u00ede un mensaje especialmente dise\u00f1ado o de gran tama\u00f1o que resulte en el bloqueo del plano de control cuando el servicio de webhooks de comprobaci\u00f3n o mutaci\u00f3n de Kubernetes est\u00e1 expuesto p\u00fablicamente. Este endpoint es servido a trav\u00e9s del puerto 15017 de TLS, pero no requiere ninguna autenticaci\u00f3n por parte del atacante. Para instalaciones sencillas, Istiod normalmente s\u00f3lo es alcanzable desde dentro del cl\u00faster, limitando el radio de explosi\u00f3n. Sin embargo, para algunos despliegues, especialmente las topolog\u00edas de istiod externas, este puerto est\u00e1 expuesto a trav\u00e9s de la Internet p\u00fablica. Las versiones 1.15.2, 1.14.5 y 1.13.9 contienen parches para este problema. no se presentan mitigaciones efectivas, m\u00e1s all\u00e1 de la actualizaci\u00f3n. Este bug es debido a un error en el archivo \\\"regexp.Compile\\\" en Go\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.13.9\",\"matchCriteriaId\":\"29E9412C-C649-4DE8-98E6-4E1F48048156\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.14.0\",\"versionEndExcluding\":\"1.14.5\",\"matchCriteriaId\":\"A330CF8F-60D8-4C9A-94E2-4F9EA328D801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.15.0\",\"versionEndExcluding\":\"1.15.2\",\"matchCriteriaId\":\"C0FE7223-1751-420F-AC19-7A6A98BC630C\"}]}]}],\"references\":[{\"url\":\"https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://istio.io/news/releases/1.14.x/announcing-1.14.5/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://istio.io/news/releases/1.14.x/announcing-1.14.5/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Istio vulnerable to denial of service attack due to Golang Regex Library\", \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-10-13T00:00:00.000Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes validating or mutating webhook service is exposed publicly. This endpoint is served over TLS port 15017, but does not require any authentication from the attacker. For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially external istiod topologies, this port is exposed over the public internet. Versions 1.15.2, 1.14.5, and 1.13.9 contain patches for this issue. There are no effective workarounds, beyond upgrading. This bug is due to an error in `regexp.Compile` in Go.\"}], \"affected\": [{\"vendor\": \"istio\", \"product\": \"istio\", \"versions\": [{\"version\": \"\u003c 1.13.9\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.14.0, \u003c 1.14.5\", \"status\": \"affected\"}, {\"version\": \"\u003e= 1.15.0, \u003c 1.15.2\", \"status\": \"affected\"}]}], \"references\": [{\"url\": \"https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w\"}, {\"url\": \"https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/\"}, {\"url\": \"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/\"}, {\"url\": \"https://istio.io/news/releases/1.14.x/announcing-1.14.5/\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\"}}], \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"lang\": \"en\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\", \"cweId\": \"CWE-400\"}]}], \"source\": {\"advisory\": \"GHSA-86vr-4wcv-mm9w\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T12:00:43.519Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/istio/istio/security/advisories/GHSA-86vr-4wcv-mm9w\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://istio.io/latest/news/releases/1.13.x/announcing-1.13.9/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://istio.io/latest/news/releases/1.15.x/announcing-1.15.2/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://istio.io/news/releases/1.14.x/announcing-1.14.5/\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-39278\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T15:50:01.018220Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T15:50:03.518Z\"}}]}",
      "cveMetadata": "{\"state\": \"PUBLISHED\", \"cveId\": \"CVE-2022-39278\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"assignerShortName\": \"GitHub_M\", \"dateUpdated\": \"2025-04-23T16:50:32.655Z\", \"dateReserved\": \"2022-09-02T00:00:00.000Z\", \"datePublished\": \"2022-10-13T00:00:00.000Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.