CVE-2022-3515

CRITICAL
Published Jan 12, 20233y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Jan 12, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-190 Integer Overflow or Wraparound Numeric Error

Affected Products 5

VendorProductVersionRange
gnupglibksba* <1.6.3
gpg4wingpg4win*≥2.0.0  –  <4.1.0
gnupgvs-desktop*≥3.1.16  –  <3.1.26
gnupggnupg*≥2.1.0  –  <2.2.41
gnupggnupg*≥2.3.0  –  <2.4.0

References 5

  • access.redhat.com https://access.redhat.com/security/cve/CVE-2022-3515
    PatchThird Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2135610
    ExploitIssue TrackingThird Party Advisory
  • dev.gnupg.org https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b
    ExploitPatchThird Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20230706-0008/
  • gnupg.org https://www.gnupg.org/blog/20221017-pepe-left-the-ksba.html
    Third Party Advisory

Remediation

  • access.redhat.com https://access.redhat.com/security/cve/CVE-2022-3515
    PatchThird Party Advisory
  • dev.gnupg.org https://dev.gnupg.org/rK4b7d9cd4a018898d7714ce06f3faf2626c14582b
    ExploitPatchThird Party Advisory