TI-2022-23657 Aliases CVE-2022-47629 GHSA-j4m3-g4pc-cph8

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

MEDIUM 45CWE-190Published 2022-12-20 · Updated 2025-04-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 20 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01674 76th percentileScored 2026-11-07

Fix Partial Red Hat: 9 advisoriesRed Hat: 20 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:gnupg:libksba::::::::	before 1.6.3	Vulnerable	GnuPG
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian

cpe:2.3:a:gnupg:libksba:*:*:*:*:*:*:*:* Versions before 1.6.3 Vulnerable ·GnuPG
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Red Hat 9 advisories

RHSA-2023:0859 Released 2023-02-21 · Red Hat rating Important
Red Hat Virtualization Host 4.4.z SP 1 security update batch#4 (oVirt-4.5.3-4)
- Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.5.3-202302150956_8.6, redhat-virtualization-host-image-update-4.5.3-202302150956_8.6
RHSA-2023:0629 Released 2023-02-07 · Red Hat rating Important
libksba security update
- Red Hat CodeReady Linux Builder EUS (v.9.0) libksba-devel-1.5.1-6.el9_0
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) libksba-1.5.1-6.el9_0
RHSA-2023:0624 Released 2023-02-07 · Red Hat rating Important
libksba security update
- Red Hat Enterprise Linux BaseOS EUS (v.8.4) libksba-1.3.5-9.el8_4
- Red Hat Enterprise Linux CRB EUS (v.8.4) libksba-devel-1.3.5-9.el8_4

Show 6 more Red Hat advisories

RHSA-2023:0626 Released 2023-02-07 · Red Hat rating Important
libksba security update
- Red Hat CodeReady Linux Builder (v. 9) libksba-devel-1.5.1-6.el9_1
- Red Hat Enterprise Linux BaseOS (v. 9) libksba-1.5.1-6.el9_1
RHSA-2023:0625 Released 2023-02-07 · Red Hat rating Important
libksba security update
- Red Hat CodeReady Linux Builder (v. 8) libksba-devel-1.3.5-9.el8_7
- Red Hat Enterprise Linux BaseOS (v. 8) libksba-1.3.5-9.el8_7
RHSA-2023:0594 Released 2023-02-06 · Red Hat rating Important
libksba security update
- Red Hat CodeReady Linux Builder EUS (v.8.6) libksba-devel-1.3.5-9.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) libksba-1.3.5-9.el8_6
RHSA-2023:0592 Released 2023-02-06 · Red Hat rating Important
libksba security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libksba-1.3.5-9.el8_2
- Red Hat Enterprise Linux BaseOS E4S (v. 8.2) libksba-1.3.5-9.el8_2
- Red Hat Enterprise Linux BaseOS TUS (v. 8.2) libksba-1.3.5-9.el8_2
RHSA-2023:0593 Released 2023-02-06 · Red Hat rating Important
libksba security update
- Red Hat Enterprise Linux BaseOS E4S (v. 8.1) libksba-1.3.5-9.el8_1
RHSA-2023:0530 Released 2023-01-30 · Red Hat rating Important
libksba security update
- Red Hat Enterprise Linux Client Optional (v. 7) libksba-1.3.0-7.el7_9, libksba-devel-1.3.0-7.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libksba-1.3.0-7.el7_9, libksba-devel-1.3.0-7.el7_9
- Red Hat Enterprise Linux Server Optional (v. 7) libksba-1.3.0-7.el7_9, libksba-1.3.0-7.el7_9.ppc, libksba-devel-1.3.0-7.el7_9 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) libksba-1.3.0-7.el7_9, libksba-devel-1.3.0-7.el7_9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat CodeReady Linux Builder (v. 8)	Fixed	RHSA-2023:0625
Red Hat CodeReady Linux Builder (v. 9)	Fixed	RHSA-2023:0626
Red Hat CodeReady Linux Builder EUS (v.8.6)	Fixed	RHSA-2023:0594
Red Hat CodeReady Linux Builder EUS (v.9.0)	Fixed	RHSA-2023:0629
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2023:0625
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2023:0626
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)	Fixed	RHSA-2023:0592
Red Hat Enterprise Linux BaseOS E4S (v. 8.1)	Fixed	RHSA-2023:0593
Red Hat Enterprise Linux BaseOS E4S (v. 8.2)	Fixed	RHSA-2023:0592
Red Hat Enterprise Linux BaseOS EUS (v.8.4)	Fixed	RHSA-2023:0624
Red Hat Enterprise Linux BaseOS EUS (v.8.6)	Fixed	RHSA-2023:0594
Red Hat Enterprise Linux BaseOS EUS (v.9.0)	Fixed	RHSA-2023:0629
Red Hat Enterprise Linux BaseOS TUS (v. 8.2)	Fixed	RHSA-2023:0592
Red Hat Enterprise Linux CRB EUS (v.8.4)	Fixed	RHSA-2023:0624
Red Hat Enterprise Linux Client Optional (v. 7)	Fixed	RHSA-2023:0530
Red Hat Enterprise Linux ComputeNode Optional (v. 7)	Fixed	RHSA-2023:0530
Red Hat Enterprise Linux Server Optional (v. 7)	Fixed	RHSA-2023:0530
Red Hat Enterprise Linux Workstation Optional (v. 7)	Fixed	RHSA-2023:0530
Red Hat JBoss Enterprise Application Platform Expansion Pack	Fixed	RHSA-2023:0756
Red Hat Virtualization 4 Hypervisor for RHEL 8	Fixed	RHSA-2023:0859

Not affected: 1 product

RHEL 8-based RHEV-H for RHEV 4 (build requirements)

Timeline

2026-10-02 Threatist record created from CVE-2022-47629
2026-10-03 Alias added: GHSA-j4m3-g4pc-cph8

References

Patch 1

https://dev.gnupg.org/T6284

Advisory 3

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences