CVE-2022-22995

NameCVE-2022-22995
DescriptionThe combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3706-1, DLA-3968-1
Debian Bugs1053545

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
netatalk (PTS)bullseye3.1.12~ds-8+deb11u1vulnerable
bullseye (security)3.1.12~ds-8+deb11u2fixed
sid, trixie4.0.8~ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
netatalksourcebuster3.1.12~ds-3+deb10u5DLA-3706-1
netatalksourcebullseye3.1.12~ds-8+deb11u2DLA-3968-1
netatalksource(unstable)3.1.18~ds-11053545

Notes

https://netatalk.sourceforge.io/CVE-2022-22995.php
https://github.com/Netatalk/netatalk/pull/509
https://github.com/Netatalk/netatalk/commit/9eb6d9d0ac17dca210ccbf05476a925a6b379dfb
Search for package or bug name: Reporting problems