First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2022-29930

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

SHA1 implementation in JetBrains Ktor Native 2.0.0 was returning the same value. The issue was fixed in Ktor version 2.0.1.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-342 CWE-330

Affected software

Vendor	Product	Versions
JetBrains	Ktor	2.0.0; >= 2.0.1, < 2.0.1

References

https://github.com/ktorio/ktor/pull/2966Patch, Third Party Advisory
https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory
https://github.com/ktorio/ktor/pull/2966Patch, Third Party Advisory
https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory

Timeline

Published: May 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299316.1The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XS CVE-2022-299327.5The HTTP Server in PRIMEUR SPAZIO 2.5.1.954 (File Transfer) allows an unauthenticated attacker to obtain sensitive data (related to the cont CVE-2022-299338.8Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password an CVE-2022-299347.8USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE CVE-2022-299357.5USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is no CVE-2022-299368.8USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upl CVE-2022-299378.8USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands CVE-2022-299388.8In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\pa CVE-2022-299395.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multip CVE-2022-299405.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to mu CVE-2022-299426.5Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perfor CVE-2022-299436.5Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve re