CVE-2022-1249 describes a NULL pointer dereference vulnerability in the pesign project's pesign software, specifically within the cms_set_pw_data() function. This flaw, which occurs when pesign attempts to daemonize, results in a denial of service. With a CVSS score of 3.3 LOW, the vulnerability requires local access and has a low impact, causing only a system crash. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 115CPE matchmatch criteria | cpe:2.3:a:pesign_project:pesign:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.
Apr 12, 2022pesign: NULL pointer dereference in cms_set_pw_data()
Mar 8, 2022