CVE-2022-4087

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of the component TLS. The manipulation of the argument pad_len leads to information exposure through discrepancy. The name of the patch is 186306d6199096b7a7c4b4574d4be8cdb8426729. It is recommended to apply a patch to fix this issue. VDB-214054 is the identifier assigned to this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284 CWE-203

Affected software

Vendor	Product	Versions
unspecified	iPXE	n/a

References

https://github.com/ipxe/ipxe/commit/186306d6199096b7a7c4b4574d4be8cdb8426729Patch, Third Party Advisory
https://vuldb.com/?id.214054Third Party Advisory
https://github.com/ipxe/ipxe/commit/186306d6199096b7a7c4b4574d4be8cdb8426729Patch, Third Party Advisory
https://vuldb.com/?id.214054Third Party Advisory

Timeline

Published: Nov 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-408708.1The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attack CVE-2022-408719.8Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr CVE-2022-408729.8An SQL injection vulnerability issue was discovered in Sourcecodester Simple E-Learning System 1.0., in /vcs/classRoom.php?classCode=, class CVE-2022-408747.5Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow vulnerability in the GetParentControlInfo function, which can cause a denial CVE-2022-408757.5Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow in the function GetParentControlInfo.CVE-2022-408769.8In Tenda ax1803 v1.0.0.1, the http requests handled by the fromAdvSetMacMtuWan functions, wanSpeed, cloneType, mac, can cause a stack overfl CVE-2022-408779.8Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.CVE-2022-408788.8In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Exe CVE-2022-408796.1kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'CVE-2022-40889.8A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality CVE-2022-408819.8SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php CVE-2022-408845.5Bento4 1.6.0 has memory leaks via the mp4fragment.