CVE-2022-4969 json
bwoodsend rockhopper Binary Parser ragged_array.c count_rows buffer overflow
published 2024-05-27 2 y ago modified 2026-07-07 4 mo ago also GHSA-4r4c-66gf-g9g5 , PYSEC-2026-1875 , EUVD-2024-1422
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local access is required to approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae693eb9b8908363d2c8ef455104e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266312.
Patch / fix
- pypi rockhopper 0.2.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 4.3 | AV:L/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 4.0 | 4.8 | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | rockhopper | <0.2.0 |
0.2.0 |
Affected products
- bwoodsend rockhopper
Classification
- Weakness
-
- CWE-120 Buffer Copy without Checking Size of Input
References
-
github.com
/bwoodsend/rockhopper/commit/1a15fad5e06ae693eb9b8908363d2c8ef455104e
patch, web
-
github.com
/bwoodsend/rockhopper/releases/tag/v0.2.0
patch, web
-
vuldb.com
/?id.266312
vdb-entry, technical-description, web
-
vuldb.com
/?ctiid.266312
signature, permissions-required, web
-
nvd.nist.gov
/vuln/detail/CVE-2022-4969
advisory
-
github.com
/bwoodsend/rockhopper
package
-
pypi.org
/project/rockhopper
package
-
github.com
/advisories/GHSA-4r4c-66gf-g9g5
advisory
Sources
- CVE List CVE-2022-4969
- GitHub Advisory GHSA-4r4c-66gf-g9g5
- NVD CVE-2022-4969
- OSV PYSEC-2026-1875
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.