VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago

CVE-2022-23219

9.8 Critical Out of RASP scope

Description

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

CWE-120

Exploitation Status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue carries this CVE. Demonstrating a defect and weaponising it are different amounts of work.

CVSS E:P

  • CISA KEV not listed
  • CISA Vulnrichment exploitation: poc CISA concluded an exploit has been demonstrated, typically from a vendor advisory, which leaves no artifact to index. Automatable: yes, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 4.2% chance in 30 days

Waratek Defense Posture

Out of RASP scope

A genuine Java vulnerability in a supported product that the agent cannot reach: a coverage gap, not an out-of-domain finding.

  • Protection none
  • Action not-needed none
  • Review human manual-review
  • Record active
Decided by manual classification : Manual classification of this CVE in the legacy dataset
Finding Manual classification marked OUT-OF-SCOPE but CVE matches known CPE products

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

VRT selects the newest version's highest entry and publishes it as cvssScore, newest rather than largest because scores are not comparable across versions, and highest rather than first because the first entry is frequently a CNA placeholder scoring 0.0 over NVD's own analysis.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 no band published AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected Software & Releases

🏛️ Oracle CPU Advisories & Products

AdvisoryTypeQuarterProducts Oracle named in risk matrix
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Systems / XCP Firmware (glibc) (Prior to XCP2411, prior to XCP3111, prior to XCP4011)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle Communications / Routing (glibc) (8.4, 9.0, 9.1)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Communications / BSF (glibc) (22.1.3)
Oracle Communications / CNE (glibc) (22.1.0)
Oracle Communications / Mediation Engine (glibc) (4.3, 4.4, 5.0)
Oracle Communications / NRF (glibc) (22.1.2, 22.2.0)
Oracle Communications / SEPP (glibc) (22.1.1)
Oracle Communications / UDR (glibc) (22.2.0)

Indexed Oracle Components & Versions

FamilyComponentOracle's version cell (verbatim)Indexed as
Oracle Communications BSF (glibc) 22.1.3 22.1.3
Oracle Communications CNE (glibc) 22.1.0 22.1.0
Oracle Communications Mediation Engine (glibc) 4.3, 4.4, 5.0 4.3 · 4.4 · 5.0
Oracle Communications NRF (glibc) 22.1.2, 22.2.0 22.1.2 · 22.2.0
Oracle Communications Routing (glibc) 8.4, 9.0, 9.1 8.4 · 9.0 · 9.1
Oracle Communications SEPP (glibc) 22.1.1 22.1.1
Oracle Communications UDR (glibc) 22.2.0 22.2.0
Oracle Systems XCP Firmware (glibc) Prior to XCP2411, prior to XCP3111, prior to XCP4011

🖥️ Product CPEs & Version Ranges

8 product(s) over 11 version claims (uncapped)
SourceVendorProductSchemeAffected Versions
nvd debian debian linux generic 10.0
nvd gnu glibc generic ＜ 2.31
nvd oracle communications cloud native core binding support function generic 22.1.3
nvd oracle communications cloud native core network function cloud native environment generic 22.1.0
nvd oracle communications cloud native core network repository function generic 22.1.2 · 22.2.0
nvd oracle communications cloud native core security edge protection proxy generic 22.1.1
nvd oracle communications cloud native core unified data repository generic 22.2.0
nvd oracle enterprise operations monitor generic 4.3 · 4.4 · 5.0

References

URLTags
https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202208-24 Third Party Advisory
https://sourceware.org/bugzilla/show_bug.cgi?id=22542 Exploit, Issue Tracking, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory

Timeline

Published 2022-01-14 Last modified 2026-06-17
Published2022-01-14By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.