CVE-2022-2929

NameCVE-2022-2929
DescriptionIn ISC DHCP 1.0 -> 4.4.3, ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3146-1, DSA-5251-1
Debian Bugs1021320

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
isc-dhcp (PTS)bookworm4.4.3-P1-2fixed
trixie4.4.3-P1-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
isc-dhcpsourcebuster4.4.1-2+deb10u2DLA-3146-1
isc-dhcpsourcebullseye4.4.1-2.3+deb11u1DSA-5251-1
isc-dhcpsource(unstable)4.4.3-2.11021320

Notes

https://www.openwall.com/lists/oss-security/2022/10/05/1
https://downloads.isc.org/isc/dhcp/4.4.3-P1/patches/
https://downloads.isc.org/isc/dhcp/4.1-ESV-R16-P2/patches/
https://kb.isc.org/docs/cve-2022-2929
Search for package or bug name: Reporting problems