Lighttpd: Incorrect Calculation
CVE-2022-30780 is a high-severity incorrect calculation vulnerability in Lighttpd, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Lighttpd versions: 1.4.56; 1.4.57; 1.4.58. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 57.2% chance of exploitation within 30 days, which is in the top 0.91% of all scored CVEs.
Exploitation in the next 30 days is more likely than not, according to EPSS.
What to do
- Check which version of Lighttpd you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on redmine.lighttpd.net for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.5 | High | NVD |
| CVSS 2.0 | 5.0 | Medium | NVD |
Official description
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
How developers prevent this class of flaw
- Understand your programming language's underlying representation and how it interacts with numeric calculation. Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, not-a-number calculations, and how your language handles numbers that are too large or too small for its underlying representation.
- Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
- Use the appropriate type for the desired action. For example, in C/C++, only use unsigned types for values that could never be negative, such as height, width, or other numbers related to quantity.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
- redmine.lighttpd.net/issues/3059Issue Tracking
Third-party and government advisories
- github.com/lighttpd/lighttpd1.4Product, Third Party Advisory
Technical write-ups (may include proof of concept)
- github.com/p0dalirius/CVE-2022-30780-lighttpd-denial-of-serviceExploit, Third Party Advisory
- podalirius.net/en/cves/2022-30780/Exploit, Third Party Advisory
Other vulnerabilities in Lighttpd
- 9.1 Critical severity
- 7.5 High severity
- 7.5 High severity
Recent Incorrect Calculation vulnerabilities
- 9.1 Critical severity
- 7.5 High severity
- 7.5 High severity
Spotted an error? Tell us.