CVE-2022-23496
Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.74%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.74% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-755
- Affected
- yet another useragent analyzer project/yet another useragent analyzer
- Source
- security-advisories@github.com
References
- https://github.com/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9ePatch, Third Party Advisory
- https://github.com/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7hThird Party Advisory
- https://github.com/nielsbasjes/yauaa/commit/3017a866e2cff0d308f264b66fde4fa79e3beb9ePatch, Third Party Advisory
- https://github.com/nielsbasjes/yauaa/security/advisories/GHSA-c4pm-63cg-9j7hThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.