Denial of Service Vulnerability in ClamAV Package - CVE-2022-20785
Summary
ALPINE-CVE-2022-20785: On April 20, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and earlier was disclosed: A vulnerability in HTML file parser of Clam AntiVirus (ClamAV) versions 0.... Affects clamav versions < 0.103.6-r0. Fixed in 0.103.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ClamAV is an open-source antivirus engine designed for detecting trojans, viruses, malware, and other malicious threats. It is widely used in various applications and systems to provide real-time protection against malware. The package is known for its flexibility and ability to scan files in multiple formats. However, certain versions of ClamAV are vulnerable to a denial of service attack due to flaws in its HTML file parser.
Vulnerability Detail
On April 20, 2022, a vulnerability was disclosed in the ClamAV scanning library affecting versions 0.103.5 and earlier, as well as 0.104.2 and earlier. This vulnerability allows an unauthenticated, remote attacker to exploit the HTML file parser, potentially leading to a denial of service condition on the affected device. The issue arises from improper handling of HTML files, which can cause the application to crash or become unresponsive.
How To Fix
Minimum fixed version
0.103.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade clamavTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the ClamAV service or disable HTML file scanning until the package is updated. This can be done by modifying the configuration file to exclude HTML files from scans.
Conclusion
CVE-2022-20785 represents a significant vulnerability in ClamAV that can lead to denial of service attacks. It is crucial for users to update their ClamAV installations to the patched versions to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for clamav →
FAQ
CVE-2022-20785 is a vulnerability in ClamAV that allows remote attackers to cause a denial of service through the HTML file parser.
The vulnerability affects ClamAV versions 0.103.5 and earlier, as well as 0.104.2 and earlier.
An attacker could exploit this vulnerability to crash the ClamAV service, leading to a denial of service condition on the affected device.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-20785 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for clamav.
