CVE-2022-38900

一、漏洞信息
 漏洞编号：[CVE-2022-38900](https://nvd.nist.gov/vuln/detail/CVE-2022-38900)
 漏洞归属组件：[cockpit-machines](https://gitee.com/src-openeuler/cockpit-machines)
 漏洞归属的版本：320
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
 漏洞公开时间：2022-11-28 21:15:10
 漏洞创建时间：2025-09-16 20:57:03
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-38900
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://github.com/SamVerschueren/decode-uri-component/issues/5 |  |
|  | https://github.com/sindresorhus/query-string/issues/345 |  |
|  | https://github.com/advisories/GHSA-w573-4hg7-7wgq |  |
|  | https://cxsecurity.com/cveshow/CVE-2022-38900/ |  |
|  | https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152 |  |
|  | https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152 |  |
|  | https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152 |  |
|  | https://github.com/SamVerschueren/decode-uri-component/blob/v0.2.0/index.js#L29 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2022-38900 |  |
|  | https://www.mend.io/vulnerability-database/CVE-2022-38900 |  |
|  | https://github.com/advisories/GHSA-w573-4hg7-7wgq |  |
|  | https://access.redhat.com/security/cve/CVE-2022-38900 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/ |  |
|  | https://www.cve.org/CVERecord?id=CVE-2022-38900 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2022-38900 |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://linux.oracle.com/cve/CVE-2022-38900.html |  |
|  | https://linux.oracle.com/errata/ELSA-2023-1743.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.1926 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.2132 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38900 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2170644 |  |
|  | https://errata.rockylinux.org/RLSA-2023:1743 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2168631 |  |
|  | https://access.redhat.com/errata/RHSA-2023:1743 |  |
|  | https://access.redhat.com/security/cve/CVE-2021-35065 |  |
|  | https://access.redhat.com/security/cve/CVE-2022-25881 |  |
|  | https://access.redhat.com/security/cve/CVE-2022-3517 |  |
|  | https://access.redhat.com/security/cve/CVE-2022-38900 |  |
|  | https://access.redhat.com/security/cve/CVE-2022-4904 |  |
|  | https://access.redhat.com/security/cve/CVE-2023-23918 |  |
|  | https://access.redhat.com/security/cve/CVE-2023-23920 |  |
|  | https://bugzilla.redhat.com/2134609 |  |
|  | https://bugzilla.redhat.com/2156324 |  |
|  | https://bugzilla.redhat.com/2165824 |  |
|  | https://bugzilla.redhat.com/2168631 |  |
|  | https://bugzilla.redhat.com/2170644 |  |
|  | https://bugzilla.redhat.com/2171935 |  |
|  | https://bugzilla.redhat.com/2172217 |  |
|  | https://errata.almalinux.org/8/ALSA-2023-1743.html |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.3143 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/ |  |
|  | https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.2 |  |
|  | https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.2 |  |
|  | https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.2 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2023.5054 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5/ |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU/ |  |
|  | https://bugzilla.redhat.com/2170644 |  |
|  | https://errata.almalinux.org/8/ALSA-2023-1743.html |  |
|  | https://errata.almalinux.org/9/ALSA-2023-6316.html |  |
|  | https://access.redhat.com/security/cve/CVE-2022-38900 |  |
|  | https://access.redhat.com/errata/RHSA-2023:1743 |  |
|  | https://access.redhat.com/errata/RHSA-2023:6316 |  |
|  | https://errata.almalinux.org/8/ALSA-2023-1743.html |  |
|  | https://errata.almalinux.org/9/ALSA-2023-6316.html |  |
|  | https://access.redhat.com/security/cve/CVE-2022-38900 |  |
|  | https://access.redhat.com/errata/RHSA-2023:1743 |  |
|  | https://access.redhat.com/errata/RHSA-2023:6316 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2022-38900 |  |
|  | https://www.auscert.org.au/bulletins/ESB-2024.0731 |  |
|  | https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ERN6YE3DS7NBW7UH44SCJBMNC2NWQ7SM |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UW4SCMT3SEUFVIL7YIADQ5K36GJEO6I5 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QABOUA2I542UTANVZIVFKWMRYVHLV32D |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KAC5KQ2SEWAMQ6UZAUBZ5KXKEOESH375 |  |
|  | https://github.com/SamVerschueren/decode-uri-component |  |
|  | https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.2.1 |  |
|  | https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VNV2GNZXOTEDAJRFH3ZYWRUBGIVL7BSU |  |
|  | https://access.redhat.com/security/updates/classification/#important |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2134609 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2156324 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2165824 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2170644 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2171935 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| SamVerschueren/decode-uri-component |  | https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9.patch |  | ljqc |
|  |  | https://github.com/SamVerschueren/decode-uri-component/commit/980e0bf09b64d94f1aa79012f895816c30ffd152 |  | snyk |
|  |  | https://github.com/SamVerschueren/decode-uri-component/commit/746ca5dcb6667c5d364e782d53c542830e4c10b9 |  | whitesource |

</details>
 
二、漏洞分析结构反馈
 影响性分析说明：
  
 openEuler评分：
   
 受影响版本排查(受影响/不受影响)：
  1.master(320):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next(320):
7.openEuler-24.03-LTS-SP1(320):
8.openEuler-24.03-LTS-SP2(320):

修复是否涉及abi变化(是/否)：
  1.master(320):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next(320):
7.openEuler-24.03-LTS-SP1(320):
8.openEuler-24.03-LTS-SP2(320):

原因说明：
  1.master(320):
2.openEuler-20.03-LTS-SP4:
3.openEuler-22.03-LTS-SP3:
4.openEuler-22.03-LTS-SP4:
5.openEuler-24.03-LTS:
6.openEuler-24.03-LTS-Next(320):
7.openEuler-24.03-LTS-SP1(320):
8.openEuler-24.03-LTS-SP2(320):

src-openEuler/cockpit-machines

内容风险标识

评论 (3)

src-openEuler/cockpit-machines .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-38900

评论 (3)

搜索帮助

src-openEuler/cockpit-machines