CVE-2022-44542

Critical

Description

lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution via a key/value pair in a hash.

SeverityCritical

CVSS9.8

Exploit probability—

ProductLesspipe

PublishedNov 1, 2022

First seenNov 1, 2022

Weakness typeCWE-502Deserialization of untrusted data

How to fix

Update

lesspipe_project lesspipe2.06 or later

Vendor advisories

security.gentoo.org/glsa/202211-02

Affected products

Product	Affected versions	Fixed in
lesspipe_project lesspipe	v < 2.06	2.06

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.