A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol Handler. The manipulation of the argument cas/ttl leads to injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.3 is able to address this issue. The patch is identified as 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to upgrade the affected component.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the     function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta     Protocol Handler. The manipulation of the argument cas/ttl leads to injection. It is possible to launch     the attack remotely. The complexity of an attack is rather high. The exploitability is told to be     difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.3 is     able to address this issue. The patch is identified as 48d594dae55934476fec61789e7a7c3700e0f50d. It is     recommended to upgrade the affected component. (CVE-2022-4064)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the
    function self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta
    Protocol Handler. The manipulation of the argument cas/ttl leads to injection. It is possible to launch
    the attack remotely. The complexity of an attack is rather high. The exploitability is told to be
    difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.3 is
    able to address this issue. The patch is identified as 48d594dae55934476fec61789e7a7c3700e0f50d. It is
    recommended to upgrade the affected component. (CVE-2022-4064)

The remote host is affected by the vulnerability described in GLSA-202405-03 (Dalli: Code Injection)

  - A vulnerability was found in Dalli. It has been classified as problematic. Affected is the function     self.meta_set of the file lib/dalli/protocol/meta/request_formatter.rb of the component Meta Protocol     Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be     used. The name of the patch is 48d594dae55934476fec61789e7a7c3700e0f50d. It is recommended to apply a     patch to fix this issue. VDB-214026 is the identifier assigned to this vulnerability. (CVE-2022-4064)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253218	Linux Distros Unpatched Vulnerability : CVE-2022-4064	Nessus	Misc.	low
409785	SCA: security update for dalli (GHSA-3xg8-cc8f-9wv2)	Tenable Cloud Security	SCA Checks	medium
409785	SCA: security update for dalli (GHSA-3xg8-cc8f-9wv2)	Tenable Self-Hosted Container Security	SCA Checks	medium
194975	GLSA-202405-03 : Dalli: Code Injection	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2022-4064

medium

Tenable Plugins

low

medium

medium

low