CVE-2022-24798: Irrd Improper Removal Of Sensitive Information Vulnerability

HIGH
Advisory Identifier: GHSA-cqxx-66wh-8pjw
Share
CVSS 7.5
CWE-212
Published
Advisory Summary

CVE-2022-24798 is a HIGH (CVSS 7.5) improper removal of sensitive information vulnerability (CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer) affecting Irrd libraries in the PyPI ecosystem. The issue involves improper removal of sensitive information before storage or transfer in irrd. Remediation is available by upgrading affected packages to version 4.2.3.

CVE-2022-24798 at a Glance

CVE Identifier CVE-2022-24798
GHSA Identifier GHSA-cqxx-66wh-8pjw
Severity HIGH
CVSS v3.1 Base Score 7.5
CWE Classification CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Affected Product Irrd
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2022-24798

To remediate this vulnerability, upgrade all affected Irrd dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

irrd fixed: 4.2.3 
pip install irrd>=4.2.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show irrd

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2022-24798, inspect your installed packages using pip:

pip show irrd

Analyze the terminal output to locate any version of Irrd in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.3), your application is affected.

Note: The pip show irrd command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer, where the product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors. In Irrd, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. The issue occurred: * For `mntner` objects where all password hash names (`MD5-PW` and `CRYPT-PW`) were in lower or mixed case in the `auth` attribute. For these objects, hashes remained in the output of all queries of any method and all database exports made with the `export_destination` setting. Fortunately, objects in the common public IRR database virtually all use uppercase hash names which means very few of those objects were affected. * For any GraphQL queries that queried the `auth` field on `mntner` objects. * For any GraphQL queries that queried the `objectText` field on the `journal` field on `mntner` objects, if the `nrtm_access_list` setting permitted journal access. The two GraphQL cases are visible in logs, allowing users to determine whether any existing objects had their hashes exposed. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. All users running a more recent version from the main branch should update to the latest version. Alternatively, but not recommended, apply the patch manually [for 4.2.x]

CVE-2022-24798 Affected Irrd Versions

1 component(s)
Fixed Versions:
4.2.3
Product / Package Ecosystem Affected Versions Fixed Version
irrd
pypi/irrd
PyPI
≥ 4.2.0
< 4.2.3
4.2.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/irrdnet/irrd/security/advisories/GHSA-cqxx-66wh-8pjw
NVD — CVE-2022-24798 NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24798
Security Fix Commit FIX COMMIT
https://github.com/irrdnet/irrd/commit/0e41bae8d3d27316381a2fc7b466597230e35ec6
Security Fix Commit FIX COMMIT
https://github.com/irrdnet/irrd/commit/fdffaf8dd71713f06e99dff417e6aa1e6fa84b70
Irrd Source Repository REPOSITORY
https://github.com/irrdnet/irrd
Irrd Source Repository REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/irrd/PYSEC-2022-178.yaml
Irrd Release RELEASE
https://irrd.readthedocs.io/en/stable/releases/4.2.3

Frequently Asked Questions

What is CVE-2022-24798?
CVE-2022-24798 is a security vulnerability in Irrd involving Improper Removal of Sensitive Information Before Storage or Transfer in irrd under CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer.
Which Irrd versions are affected?
Affected versions include releases prior to 4.2.3 across affected packages: irrd.
What version fixes CVE-2022-24798?
Upgrading to 4.2.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is irrd affected?
Yes, irrd is affected in releases prior to 4.2.3. Upgrade your dependency to 4.2.3 or later.
What is the CVSS score of CVE-2022-24798?
CVE-2022-24798 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
What CWE is associated with CVE-2022-24798?
CVE-2022-24798 is classified under CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer (The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.).
How can I check PyPI dependencies for CVE-2022-24798?
Run the dependency tree command: 'pip show irrd'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cqxx-66wh-8pjw",
  "modified" : "2024-09-24T21:11:09Z",
  "published" : "2022-04-01T13:59:17Z",
  "aliases" : [ "CVE-2022-24798" ],
  "summary" : "Improper Removal of Sensitive Information Before Storage or Transfer in irrd",
  "details" : "IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected.\n\nThe issue occurred:\n* For `mntner` objects where all password hash names (`MD5-PW` and `CRYPT-PW`) were in lower or mixed case in the `auth` attribute. For these objects, hashes remained in the output of all queries of any method and all database exports made with the `export_destination` setting. Fortunately, objects in the common public IRR database virtually all use uppercase hash names which means very few of those objects were affected.\n* For any GraphQL queries that queried the `auth` field on `mntner` objects.\n* For any GraphQL queries that queried the `objectText` field on the `journal` field on `mntner` objects, if the `nrtm_access_list` setting permitted journal access.\n\nThe two GraphQL cases are visible in logs, allowing users to determine whether any existing objects had their hashes exposed.\nThis has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. All users running a more recent version from the main branch should update to the latest version. Alternatively, but not recommended, apply the patch manually [for 4.2.x]",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "irrd"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.2.0"
      }, {
        "fixed" : "4.2.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/irrdnet/irrd/security/advisories/GHSA-cqxx-66wh-8pjw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-24798"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/irrdnet/irrd/commit/0e41bae8d3d27316381a2fc7b466597230e35ec6"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/irrdnet/irrd/commit/fdffaf8dd71713f06e99dff417e6aa1e6fa84b70"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/irrdnet/irrd"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/irrd/PYSEC-2022-178.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://irrd.readthedocs.io/en/stable/releases/4.2.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-212" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-04-01T13:59:17Z",
    "nvd_published_at" : "2022-03-31T23:15:00Z"
  }
}