Skip to content
Fencer Vulns
critical 9.8

CVE-2022-23121 json

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.

published 2023-03-28 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-28212

cvss
9.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
8.5%
EPSS 8.5% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.

Patch / fix

  • netatalk netatalk 3.1.13
  • netatalk Debian 14, Debian 13 3.1.13~ds-1

debian advisories DEBIAN-CVE-2022-23121

  • netatalk Ubuntu 20.04 LTS 3.1.12~ds-4ubuntu0.20.04.1
  • netatalk Ubuntu 22.04 LTS 3.1.12~ds-9ubuntu0.22.04.1
  • netatalk Ubuntu Pro 14.04 LTS 2.2.2-1ubuntu2.2+esm1
  • netatalk Ubuntu Pro 16.04 LTS 2.2.5-1ubuntu0.2+esm1
  • netatalk Ubuntu Pro 18.04 LTS 2.2.6-1ubuntu0.18.04.2+esm1

ubuntu advisories UBUNTU-CVE-2022-23121

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • netatalk SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 3.1.0-3.8.1

suse advisories SUSE-SU-2022:1184-1

  • netatalk Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 3.1.13-r0

alpine advisories ALPINE-CVE-2022-23121

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

8.53% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Netatalk Netatalk

Classification

Weakness
  • CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.