CVE-2022-40281

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer_certificate, leading to information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/curl/vtls/cyassl.c#L545Third Party Advisory
https://github.com/Samsung/TizenRT/issues/5626Issue Tracking, Third Party Advisory
https://www.openssl.org/docs/man1.1.1/man3/SSL_get_peer_certificate.htmlThird Party Advisory
https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/curl/vtls/cyassl.c#L545Third Party Advisory
https://github.com/Samsung/TizenRT/issues/5626Issue Tracking, Third Party Advisory
https://www.openssl.org/docs/man1.1.1/man3/SSL_get_peer_certificate.htmlThird Party Advisory

Timeline

Published: Sep 8, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-402828.8The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to p CVE-2022-402847.8A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker c CVE-2022-402879.0The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, l CVE-2022-402889.0The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leverag CVE-2022-402899.0The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could b CVE-2022-40294.7The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cooki CVE-2022-402906.1The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functional CVE-2022-402918.8The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious req CVE-2022-402925.3The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each accou CVE-2022-402939.8The application was vulnerable to a session fixation that could be used hijack accounts.CVE-2022-402948.8The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be embedded within expo CVE-2022-402954.9The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which co