CVE-2022-2509

Published: Aug 1, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Affected (6)

Products: Gnu: Gnutls · Redhat: Enterprise Linux · Fedoraproject: Fedora · +1 more

Show all products

Gnu: Gnutls · Redhat: Enterprise Linux · Fedoraproject: Fedora · Debian: Debian Linux

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Before 3.7.7

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 35

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Related CWEs

CWE-415

Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (10)

https://access.redhat.com/security/cve/CVE-2022-2509

Source: secalert@redhat.com

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/

Source: secalert@redhat.com

https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html

Source: secalert@redhat.com

Mailing ListRelease NotesVendor Advisory

https://www.debian.org/security/2022/dsa-5203

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2022-2509