Is CVE-2022-41777 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-41777 being exploited in the wild.

How severe is CVE-2022-41777?

Low severity, with a CVSS score of 3, published 5 December 2022.

Which products and versions are affected?

nadesiko3 (npm) SEMVER:introduced=0,fixed=3.3.75.

Is there a fix for CVE-2022-41777?

Yes. nadesiko3 (npm): upgrade to 3.3.75 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-41777 attacked?

It is attacked over the network.

Am I affected by CVE-2022-41777?

Check whether you run nadesiko3 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-41777: nadesiko3 Denial of Service in decodeURIComponent handling

CVE-2022-41777 · Severity: low · CVSS 3 · Published 2022-12-05

Nadesiko3 is a programming language environment with an editor component (nako3edit). A remote attacker can send specially crafted input that triggers improper exception handling in the URI decoder, causing the server to crash. This creates a denial of service vulnerability affecting availability of systems running affected versions.

Technologies: nadesiko3 (npm). Vendors: npm.

Quick answers

Is CVE-2022-41777 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-41777 being exploited in the wild.
How severe is CVE-2022-41777?: Low severity, with a CVSS score of 3, published 5 December 2022.
Which products and versions are affected?: nadesiko3 (npm) SEMVER:introduced=0,fixed=3.3.75.
Is there a fix for CVE-2022-41777?: Yes. nadesiko3 (npm): upgrade to 3.3.75 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-41777 attacked?: It is attacked over the network.
Am I affected by CVE-2022-41777?: Check whether you run nadesiko3 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nadesiko3 (npm): upgrade to 3.3.75 or later
```
npm install nadesiko3@3.3.75
```

Technical details

Nako3edit in nadesiko3 v3.3.74 and earlier contains improper exception handling (CWE-703, CWE-755) in the decodeURIComponent function. An unauthenticated remote attacker can send invalid URI-encoded values over the network without any special privileges, causing an uncaught exception that crashes the server. The vulnerability has been patched in version 3.3.75. The root cause is insufficient validation and error handling of malformed input passed to the decodeURIComponent decoder.

Affected products

kujirahand nadesiko3 3.3.74 and earlier

Identifiers

CVE-2022-41777
GHSA-x2jx-w3wm-9p3p

Timeline

2022-12-05: disclosed: GHSA-x2jx-w3wm-9p3p and CVE-2022-41777 published
2022: patched: Fixed in version 3.3.75

References

https://github.com/kujirahand/nadesiko3/issues/1325

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.