{"id":"CVE-2022-1249","aliases":["AZL-9655","EUVD-2022-24582","GHSA-3xpm-4m85-6353","UBUNTU-CVE-2022-1249"],"status":"published","title":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the...","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00247,"percentile":0.16078,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2022-04-29T15:43:10Z","modified":"2026-10-17T12:55:55Z","affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.112-32"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.110-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112-6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.112-6","116-6","116-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["116-8","116-8.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["116-8.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"pesign","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["116-8.1","116-8.1build1"]}],"products":[{"vendor":"microsoft","product":"pesign"},{"vendor":"pesign_project","product":"pesign"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2065771","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1249","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3xpm-4m85-6353"},{"url":"https://ubuntu.com/security/CVE-2022-1249","tags":["report"]},{"url":"https://github.com/rhboot/pesign/pull/79","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1249","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-1249","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","status":"published","published":"2022-04-29T15:43:10Z","modified":"2024-08-02T23:55:24.575Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-24582","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","status":"published","published":"2022-04-29T15:43:10Z","modified":"2024-08-02T23:55:24Z","updated_at":"2026-11-03T03:26:01.998866Z"}],"ghsa":[{"id":"GHSA-3xpm-4m85-6353","title":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the...","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","status":"published","published":"2022-04-30T00:00:36Z","modified":"2023-01-30T05:04:16Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:47:00.339893Z"}],"nvd":[{"id":"CVE-2022-1249","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","status":"published","published":"2022-04-29T16:15:08.807Z","modified":"2026-06-17T04:22:05.373Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"AZL-9655","title":"CVE-2022-1249 affecting package pesign 0.112-32","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","status":"published","published":"2022-04-29T16:15:08Z","modified":"2026-04-21T04:35:06.343397Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:28:12.028669Z"},{"id":"UBUNTU-CVE-2022-1249","description":"A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.","status":"published","published":"2022-04-29T16:15:00Z","modified":"2026-10-17T12:55:55.92686505Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:53:51.630172Z"}]}}