{"id":"CVE-2022-2301","aliases":["DEBIAN-CVE-2022-2301","EUVD-2022-34573","GHSA-rc7h-3q8g-vxjc","JLSEC-2026-1091","UBUNTU-CVE-2022-2301","openSUSE-SU-2022:10044-1","openSUSE-SU-2022:10045-1"],"status":"published","title":"Buffer Over-read in hpjansson/chafa","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00664,"percentile":0.52022,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-126"],"published":"2022-07-04T10:30:22Z","modified":"2026-10-28T10:25:17Z","fixes":[{"ecosystem":"Debian:12","package":"chafa","fixed_in":["1.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"chafa","fixed_in":["1.10.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"chafa","fixed_in":["1.10.3-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"chafa","fixed_in":["1.4.1-bp153.2.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"chafa","fixed_in":["1.4.1-bp153.2.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"chafa","fixed_in":["1.8.0-bp154.3.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"chafa","fixed_in":["1.8.0-bp154.3.8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"Chafa_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.8.0-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-bp153.2.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1-bp153.2.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-bp154.3.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"chafa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-bp154.3.8.1"}]}]}],"products":[{"vendor":"chafa_project","product":"chafa"},{"vendor":"hpjansson","product":"hpjansson/chafa"}],"references":[{"url":"https://huntr.dev/bounties/f6b9114b-671d-4948-b946-ffe5c9aeb816","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","web","report"]},{"url":"https://github.com/hpjansson/chafa/commit/56fabfa18a6880b4cb66047fa6557920078048d9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2301","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rc7h-3q8g-vxjc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2301.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-2301","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-2301","tags":["report"]},{"url":"https://huntr.dev/bounties/f6b9114b-671d-4948-b946-ffe5c9aeb816/","tags":["report"]},{"url":"https://github.com/hpjansson/chafa/commit/a52325294cc018d4fa9a7f29668faea24362b94c","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2301","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6MJ4FKDFLGENN5FLV6DJ2YONDN6D6EAG/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201211","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2301","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PX5AWM27AFS35SS2ZQEF5DK6J25BVQW6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-2301","title":"Buffer Over-read in hpjansson/chafa","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-04T10:30:22Z","modified":"2024-08-03T00:32:09.618Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-34573","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-04T10:30:22Z","modified":"2024-08-03T00:32:09Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:25:58.940602Z"}],"ghsa":[{"id":"GHSA-rc7h-3q8g-vxjc","title":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-05T00:00:54Z","modified":"2023-01-27T05:05:11Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:42:38.42731Z"}],"nvd":[{"id":"CVE-2022-2301","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-04T11:15:13.357Z","modified":"2026-06-17T04:41:39.36Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-126","CWE-125"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"CVE-2022-2301","title":"Buffer Over-read in hpjansson/chafa","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-04T10:30:22Z","modified":"2026-10-28T10:25:17.494357441Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-126"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"DEBIAN-CVE-2022-2301","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-04T11:15:13.357Z","modified":"2026-11-03T08:03:49.864088098Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"JLSEC-2026-1091","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2026-07-31T20:09:46.097Z","modified":"2026-07-31T20:15:03.864254878Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"UBUNTU-CVE-2022-2301","description":"Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.","status":"published","published":"2022-07-04T11:15:00Z","modified":"2026-04-22T13:17:28.499604Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"openSUSE-SU-2022:10044-1","title":"Security update for chafa","description":"This update for chafa fixes the following issues:\n\n- CVE-2022-2301: Fix buffer over-read (boo#1201211)\n","status":"published","published":"2022-07-08T18:01:15Z","modified":"2026-02-04T02:32:59.284974Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10045-1","title":"Security update for chafa","description":"This update for chafa fixes the following issues:\n\n- CVE-2022-2301: Fixed buffer over-read (boo#1201211)\n","status":"published","published":"2022-07-08T18:01:18Z","modified":"2026-02-04T03:06:34.772489Z","updated_at":"2026-11-02T16:58:32.653274Z"}]}}