Denial of Service Vulnerability in ClamAV (CVE-2022-20698)
Summary
CVE-2022-20698: A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service cond... Affects clamav across 2 version ranges.
< 0.103.6-r0
< 5faab1937cc2b89049ef7748dc9a10545707613d
Fixed in 0.103.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Clam AntiVirus (ClamAV) is an open-source antivirus software package that provides protection against various types of malware. It is widely used in both personal and enterprise environments. The software includes an OOXML parsing module responsible for handling OOXML files. This module is vulnerable to a denial of service attack due to improper checks that may result in an invalid pointer read.
Vulnerability Detail
The vulnerability (CVE-2022-20698) in ClamAV allows an unauthenticated, remote attacker to cause a denial of service condition on an affected device. By sending a specially crafted OOXML file, the attacker can exploit the vulnerability and cause the ClamAV scanning process to crash. This results in a denial of service, rendering the antivirus protection temporarily unavailable. The vulnerability is rated with a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
0.103.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating ClamAV to the recommended version.
Conclusion
The vulnerability in ClamAV (CVE-2022-20698) allows an attacker to cause a denial of service condition by exploiting the OOXML parsing module. To mitigate this vulnerability, it is crucial to update ClamAV to version 0.103.6-r0 or later. Regularly updating antivirus software is essential to protect against potential vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for clamav →
FAQ
ClamAV is an open-source antivirus software package used to detect and remove malware from systems.
The vulnerability allows an attacker to crash the ClamAV scanning process, resulting in a denial of service condition and temporary unavailability of antivirus protection.
To protect your system, update ClamAV to version 0.103.6-r0 or later, as it includes the necessary fixes to address the vulnerability.
No, an unauthenticated, remote attacker can exploit this vulnerability.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
