Bug 2106292 (CVE-2022-1955) - CVE-2022-1955 perl-SNMP_Session: lack of adequate security controls may lead to information disclosure
Summary: CVE-2022-1955 perl-SNMP_Session: lack of adequate security controls may lead ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-1955
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2106293
Blocks: 2106295
TreeView+ depends on / blocked
 
Reported: 2022-07-12 10:09 UTC by Marian Rehak
Modified: 2022-07-25 07:54 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2022-07-25 07:54:30 UTC
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2022-07-12 10:09:31 UTC 
An attacker with physical access to the victim's device may bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation.

Reference:

https://fluidattacks.com/advisories/tempest/
Comment 1 Marian Rehak 2022-07-12 10:09:47 UTC 
Created perl-SNMP_Session tracking bugs for this issue:

Affects: fedora-all [bug 2106293]
Comment 2 Petr Pisar 2022-07-12 10:40:13 UTC 
CVE-2022-1955 is not about perl-SNMP_Session <https://github.com/sleinen/snmp-session>, a SNMP protocol in Perl language. This vulnerability <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1955> is in <https://github.com/oxen-io/session-android>, a messaging application for Android OS using Oxen mixing network.

I believe that neither Fedora, nor RHEL deliver this piece of software and this bug report can be closed.
Comment 3 TEJ RATHI 2022-07-25 07:54:11 UTC 
Agree, This one is not related to perl-snmp-session. It is something related to oxen-io/session-android package which does not shipped in RHEL and not even Fedora. I'm closing out this bug.
Note You need to log in before you can comment on or make changes to this bug.