CVE-2022-4899
CVE Details
Visit the official vulnerability details page for CVE-2022-4899 to learn more.
Initial Publication
10/25/2024
Last Update
10/25/2024
Third Party Dependency
libzstd1
NIST CVE Summary
A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.
CVE Severity
Our Official Summary
This vulnerability is reported on several 3rd party images used by the product. We are waiting on an upstream fix from the vendor.
Status
Ongoing
Affected Products & Versions
| Version | Palette Enterprise | Palette Enterprise Airgap | VerteX | VerteX Airgap |
|---|---|---|---|---|
| 4.5.11 | Impacted | Impacted | Impacted | Impacted |
| 4.5.10 | Impacted | Impacted | Impacted | Impacted |
| 4.5.8 | Impacted | Impacted | Impacted | Impacted |
| 4.5.5 | Impacted | Impacted | Impacted | Impacted |
| 4.5.4 | Impacted | Impacted | Impacted | Impacted |
| 4.4.20 | Impacted | Impacted | Impacted | Impacted |
Revision History
| Date | Revision |
|---|---|
| 11/15/2024 | Impacted versions changed from 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10 to 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10, 4.5.11 |
| 11/15/2024 | Impacted versions changed from 4.5.4, 4.5.5, 4.5.8, 4.4.20 to 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10 |
| 11/13/2024 | Impacted versions changed from 4.5.4, 4.5.5, 4.5.8 to 4.5.4, 4.5.5, 4.5.8, 4.4.20 |
| 11/10/2024 | Impacted versions changed from 4.5.4, 4.5.5 to 4.5.4, 4.5.5, 4.5.8 |
| 10/27/2024 | Impacted versions changed from 4.5.4 to 4.5.4, 4.5.5 |