Sign-up

ID

VAR-202211-0550


CVE

CVE-2022-20927


TITLE

Vulnerabilities in multiple Cisco Systems products

Trust: 0.8

sources: JVNDB: JVNDB-2022-022982

DESCRIPTION

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this vulnerability by ensuring that the device will connect to an SSL/TLS server that is using specific encryption parameters. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition

Trust: 1.71

sources: NVD: CVE-2022-20927 // JVNDB: JVNDB-2022-022982 // VULHUB: VHN-405480

AFFECTED PRODUCTS

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.1.19

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.2.15

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.2

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.3

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3.1

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.4

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.2.4

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:lteversion:6.7.0.3

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3.15

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.2.13

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.1.30

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.7

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3.9

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.19

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.2.8

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.17

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3.18

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.12

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.1.10

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.15

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3.11

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.5.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.2

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:gteversion:6.7.0

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.1.15

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.0

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:gteversion:6.5.0

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:eqversion:6.6.0.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.16

Trust: 1.0

vendor:ciscomodel:firepower services software for asascope:eqversion: -

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:lteversion:6.5.0.5

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.21

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.16

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.14.3.13

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.15.1.21

Trust: 1.0

vendor:ciscomodel:adaptive security appliance softwarescope:eqversion:9.13.1.13

Trust: 1.0

vendor:シスコシステムズmodel:cisco firepower services for asascope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco adaptive security appliance ソフトウェアscope: - version: -

Trust: 0.8

vendor:シスコシステムズmodel:cisco firepower threat defense ソフトウェアscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-022982 // NVD: CVE-2022-20927

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-20927
value: MEDIUM

Trust: 1.8

ykramarz@cisco.com: CVE-2022-20927
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202211-2506
value: MEDIUM

Trust: 0.6

NVD:
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

ykramarz@cisco.com:
baseSeverity: HIGH
baseScore: 7.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.1
impactScore: 4.0
version: 3.1

Trust: 1.0

NVD: CVE-2022-20927
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-022982 // CNNVD: CNNVD-202211-2506 // NVD: CVE-2022-20927 // NVD: CVE-2022-20927

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-119

Trust: 0.1

sources: VULHUB: VHN-405480 // JVNDB: JVNDB-2022-022982 // NVD: CVE-2022-20927

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202211-2506

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202211-2506

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-20927

PATCH
title:cisco-sa-ssl-client-dos-cCrQPkAurl:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ssl-client-dos-ccrqpka
Trust: 0.8
title:Cisco Firepower Threat Defense  and Cisco Adaptive Security Appliances Software Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=215187
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2022-022982 // 
            
            
            
            CNNVD: CNNVD-202211-2506

EXTERNAL IDS
db:NVDid:CVE-2022-20927
Trust: 3.3
db:JVNDBid:JVNDB-2022-022982
Trust: 0.8
db:CNNVDid:CNNVD-202211-2506
Trust: 0.6
db:VULHUBid:VHN-405480
Trust: 0.1
sources:
            
            
            VULHUB: VHN-405480 // 
            
            
            
            JVNDB: JVNDB-2022-022982 // 
            
            
            
            CNNVD: CNNVD-202211-2506 // 
            
            
            
            NVD: CVE-2022-20927

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2022-20927
Trust: 1.4
url:https://sec.cloudapps.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ssl-client-dos-ccrqpka
Trust: 1.0
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ssl-client-dos-ccrqpka
Trust: 0.7
url:https://vigilance.fr/vulnerability/cisco-asa-denial-of-service-via-ssl-tls-client-39889
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2022-20927/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-405480 // 
            
            
            
            JVNDB: JVNDB-2022-022982 // 
            
            
            
            CNNVD: CNNVD-202211-2506 // 
            
            
            
            NVD: CVE-2022-20927

SOURCES
db:VULHUBid:VHN-405480
db:JVNDBid:JVNDB-2022-022982
db:CNNVDid:CNNVD-202211-2506
db:NVDid:CVE-2022-20927

LAST UPDATE DATE
2024-01-29T19:27:39.346000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-405480date:2022-11-22T00:00:00
db:JVNDBid:JVNDB-2022-022982date:2023-11-24T01:54:00
db:CNNVDid:CNNVD-202211-2506date:2022-11-23T00:00:00
db:NVDid:CVE-2022-20927date:2024-01-25T17:15:19.423

SOURCES RELEASE DATE
db:VULHUBid:VHN-405480date:2022-11-15T00:00:00
db:JVNDBid:JVNDB-2022-022982date:2023-11-24T00:00:00
db:CNNVDid:CNNVD-202211-2506date:2022-11-09T00:00:00
db:NVDid:CVE-2022-20927date:2022-11-15T21:15:32.607