{"id":"CVE-2022-4132","state":"PUBLISHED","title":"Memory leak on tls connections","description":"A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page).","publishedAt":"2023-10-04T11:26:11.191Z","updatedAt":"2024-09-19T14:41:40.138Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"redhat"},"assigner":"redhat","products":["n/a jss","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat JBoss Web Server 3","Red Hat Red Hat JBoss Web Server 5","Fedora Extra Packages for Enterprise Linux","Fedora Fedora"],"affected":[{"vendor":"n/a","product":"jss","versions":[{"version":"5.5.0","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"jss","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"tomcatjss","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"jss","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"tomcat","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"jss","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/pki-servlet-engine","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"jss","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-servlet-engine","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 3","packageName":"tomcat7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:3"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 3","packageName":"tomcat8","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:3"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 5","packageName":"jws5-tomcat","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:5"]},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux","packageName":"jss","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"jss","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"tomcat","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux","packageName":"tomcat","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":["https://access.redhat.com/security/cve/CVE-2022-4132","https://bugzilla.redhat.com/show_bug.cgi?id=2147372"],"weaknesses":["CWE-401"],"ingestedAt":"2026-10-29T20:05:26.763Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/4xxx/CVE-2022-4132.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-4132","state":"PUBLISHED","datePublished":"2023-10-04T11:26:11.191Z","dateUpdated":"2024-09-19T14:41:40.138Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2022-11-23T20:20:38.318Z"},"containers":{"cna":{"title":"Memory leak on tls connections","descriptions":[{"lang":"en","value":"A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page)."}],"affected":[{"vendor":"n/a","product":"jss","versions":[{"version":"5.5.0","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"jss","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"tomcatjss","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"jss","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"tomcat","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"jss","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/pki-servlet-engine","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"jss","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-servlet-engine","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 3","packageName":"tomcat7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:3"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 3","packageName":"tomcat8","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:3"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 5","packageName":"jws5-tomcat","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:5"]},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux","packageName":"jss","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"jss","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Fedora","packageName":"tomcat","defaultStatus":"unaffected","collectionURL":"https://packages.fedoraproject.org/"},{"vendor":"Fedora","product":"Extra Packages for Enterprise Linux","packageName":"tomcat","defaultStatus":"affected","collectionURL":"https://packages.fedoraproject.org/"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2022-4132","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2147372","name":"RHBZ#2147372","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-401","description":"Missing Release of Memory after Effective Lifetime","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2023-10-04T11:26:11.191Z"},"datePublic":"2022-11-23T00:00:00.000Z","x_redhatCweChain":"CWE-401: Missing Release of Memory after Effective Lifetime","timeline":[{"lang":"en","time":"2022-11-23T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2022-11-23T00:00:00.000Z","value":"Made public."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2022-4132","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2147372","name":"RHBZ#2147372","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T01:27:54.494Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-19T14:41:27.673796Z","id":"CVE-2022-4132","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-19T14:41:40.138Z"}}]}}}