Denial of Service Vulnerability in ClamAV Package - CVE-2022-20770
Summary
ALPINE-CVE-2022-20770: On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in CHM file parser of Clam AntiVirus (ClamAV) versions 0.1... Affects clamav versions < 0.103.6-r0. Fixed in 0.103.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting trojans, viruses, malware, and other malicious threats. It is widely used in various applications to provide security against malware. The package is known for its versatility and effectiveness in scanning files and emails for potential threats. However, certain versions of ClamAV have been found to be vulnerable to a denial of service attack due to flaws in its CHM file parser.
Vulnerability Detail
On April 20, 2022, a vulnerability was disclosed in the ClamAV scanning library affecting versions 0.103.5 and earlier, as well as 0.104.2 and earlier. This vulnerability allows an unauthenticated, remote attacker to exploit the CHM file parser, potentially leading to a denial of service condition on affected devices. The vulnerability is significant as it can disrupt the normal functioning of systems relying on ClamAV for malware detection, making them susceptible to further attacks.
How To Fix
Minimum fixed version
0.103.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the scanning of CHM files until the package is updated. This can be done by modifying the ClamAV configuration file, typically located at '/etc/clamav/clamd.conf', to exclude CHM files from being scanned.
Conclusion
In summary, CVE-2022-20770 represents a significant vulnerability in the ClamAV package that can lead to denial of service attacks. It is crucial for users to update their ClamAV installations to the patched version to mitigate this risk. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for clamav →
FAQ
CVE-2022-20770 is a vulnerability in the ClamAV antivirus engine that allows remote attackers to cause a denial of service through a flaw in the CHM file parser.
The vulnerability affects ClamAV versions 0.103.5 and earlier, as well as 0.104.2 and earlier.
An attacker can exploit this vulnerability to cause a denial of service, disrupting the normal operation of systems using ClamAV.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
The CVSS score for CVE-2022-20770 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
