CVE-2022-1304 | e2fsprogs (CWE-125)

[yeyisan]

A high severity vulnerability has been discovered in your project.

Project Name: Node

Scanner Name: trivy

Cwe ID: 125

Cwe Name: Out-of-bounds Read

Cwe Link: https://cwe.mitre.org/data/definitions/125.html

CVE ID: CVE-2022-1304

Target: redis:latest (debian 11.3)

Packages:

• e2fsprogs : 1.46.2-2 - Fixed Version:

References:

• https://bugzilla.redhat.com/show_bug.cgi?id=2069726
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1304
• https://marc.info/?l=linux-ext4&m=165056234501732&w=2

Training(Secure Code Warrior):

• Name: Out-of-bounds Read

• Description: The software reads data past the end, or before the beginning, of the intended buffer.

• Link: https://portal.securecodewarrior.com/?utm_source=partner-integration:kondukto#/website-trial/web/memory

• Videos:

Tool Description: An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Custom Description: nnn