9.8

CVE-2022-3515: gnupg Integer Overflow or Wraparound

CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2022-3515MGASA-2022-0404SUSE-SU-2022:3681-1
Published 12-01-2023Last modified 08-04-2025
Open JSON

Vulnerability summary

CVE-2022-3515 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in gnupg. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76.1% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
1.65%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
RHSA-2022:8598CGA-HJ23-XHX9-J523CGA-P93G-6CQ2-HVPJ

Timeline

  1. 12-01-2023
    PublishedVulnerability first disclosed.
  2. 08-04-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

1.65%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

0.00 pp

From 1.65% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.65%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (dev.gnupg.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse33 products
  • libksba&distro=SUSE Enterprise Storage 6< 1.3.5-150000.4.3.1
  • libksba&distro=SUSE Enterprise Storage 7< 1.3.5-150000.4.3.1
  • libksba&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.3.5-150000.4.3.1
  • libksba&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.3.5-150000.4.3.1
  • libksba&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 1.3.5-150000.4.3.1
Opensuse4 products
  • libksba&distro=openSUSE Leap 15.3< 1.3.5-150000.4.3.1
  • libksba&distro=openSUSE Leap 15.4< 1.3.5-150000.4.3.1
  • libksba&distro=openSUSE Leap Micro 5.2< 1.3.5-150000.4.3.1
  • libksba&distro=openSUSE Tumbleweed< 1.6.2-1.1
Redhat4 products
  • libksba< 0:1.3.0-6.el7_9 | < 0:1.3.5-8.el8_6 | < 0:1.5.1-5.el9_0 | < 0:1.3.5-8.el8_1 | < 0:1.3.5-8.el8_2 | < 0:1.3.5-8.el8_4
  • libksba-debuginfo< 0:1.3.0-6.el7_9 | < 0:1.3.5-8.el8_6 | < 0:1.5.1-5.el9_0 | < 0:1.3.5-8.el8_1 | < 0:1.3.5-8.el8_2 | < 0:1.3.5-8.el8_4
  • libksba-debugsource< 0:1.3.5-8.el8_6 | < 0:1.5.1-5.el9_0 | < 0:1.3.5-8.el8_1 | < 0:1.3.5-8.el8_2 | < 0:1.3.5-8.el8_4
  • libksba-devel< 0:1.3.0-6.el7_9 | < 0:1.3.5-8.el8_6 | < 0:1.5.1-5.el9_0 | < 0:1.3.5-8.el8_4
Gnupg3 products
Alpine1 product
  • libksba< 1.5.1-r1 | < 1.6.3-r0 | < 1.6.2-r0
Chainguard1 product
  • libksbaAll versions (No fix recorded)
Debian1 product
  • libksba< 1.5.0-3+deb11u1 | < 1.3.5-2+deb10u1 | < 1.6.2-1
Gpg4win1 product
Mageia1 product
  • libksba< 1.5.0-1.1.mga8
Ubuntu1 product
  • libksba< 1.3.0-3ubuntu0.14.04.2+esm1 | < 1.3.3-1ubuntu0.16.04.1+esm1 | < 1.3.5-2ubuntu0.18.04.1 | < 1.3.5-2ubuntu0.20.04.1 | < 1.6.0-2ubuntu0.1
Wolfi1 product
  • libksbaAll versions (No fix recorded)

11 vendors · 51 products

References

33 links
Show all 33 references