CVE-2022-38493

    Dashboard / Vulnerabilities / CVE-2022-38493

    CVE-2022-38493

    Published: 20 Aug 2022Last Modified: 12 Aug 2026

    Summary:

    Details: Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Service via a crafted JWE (JSON Web Encryption) token.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38493.json, https://nvd.nist.gov/vuln/detail/CVE-2022-38493, https://github.com/babelouest/rhonabwy/commit/dd528b3aabd13863f855a68e76966e4e019fc399

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d439802e37931e1e456be0df29da5bab1056eef3
    Fixed -775a8e82719571ab8328a0782bcf40133ec65bfd

    Affected versions

    v1.1.5
    v1.1.4
    v1.1.3
    v1.1.2
    v1.1.1
    v1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-38493 | CVE-DB