TI-2022-22929 Aliases CVE-2022-46397 GHSA-xxw7-44hw-5xgc

FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09…

MEDIUM 40CWE-329Published 2023-03-28 · Updated 2025-02-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09, 20.05, 20.01, 19.08, and 19.04 Generates a Predictable IV with CBC Mode.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0062 49th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:vector_packet_processor:19.04:::::::*	19.04	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:19.08:::::::*	19.08	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:20.01:::::::*	20.01	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:20.05:::::::*	20.05	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:20.09:::::::*	20.09	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:21.01:::::::*	21.01	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:21.06:::::::*	21.06	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:21.10:::::::*	21.10	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:22.02:::::::*	22.02	Vulnerable	MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:22.06:::::::*	22.06	Vulnerable	MLflow

cpe:2.3:a:lfprojects:vector_packet_processor:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:19.08:*:*:*:*:*:*:* Versions 19.08 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:20.01:*:*:*:*:*:*:* Versions 20.01 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:20.05:*:*:*:*:*:*:* Versions 20.05 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:20.09:*:*:*:*:*:*:* Versions 20.09 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:21.01:*:*:*:*:*:*:* Versions 21.01 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:21.06:*:*:*:*:*:*:* Versions 21.06 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:21.10:*:*:*:*:*:*:* Versions 21.10 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:22.02:*:*:*:*:*:*:* Versions 22.02 Vulnerable ·MLflow
cpe:2.3:a:lfprojects:vector_packet_processor:22.06:*:*:*:*:*:*:* Versions 22.06 Vulnerable ·MLflow

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:vector_packet_processor:22.10:::::::*	22.10	Vulnerable	MLflow

cpe:2.3:a:lfprojects:vector_packet_processor:22.10:*:*:*:*:*:*:* Versions 22.10 Vulnerable ·MLflow

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-46397
2026-10-03 Alias added: GHSA-xxw7-44hw-5xgc

References

Advisory 1

https://lists.fd.io/g/security-announce/message/2

Other 1

https://s3-docs.fd.io/vpp/23.02/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences