{"id":"USN-6236-1","summary":"connman vulnerabilities","details":"It was discovered that ConnMan could be made to write out of bounds. A\nremote attacker could possibly use this issue to cause ConnMan to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2021-26675, CVE-2021-33833)\n\nIt was discovered that ConnMan could be made to leak sensitive information\nvia the gdhcp component. A remote attacker could possibly use this issue\nto obtain information for further exploitation. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-26676)\n\nIt was discovered that ConnMan could be made to read out of bounds. A\nremote attacker could possibly use this issue to case ConnMan to crash,\nresulting in a denial of service. This issue only affected Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2022-23096, CVE-2022-23097)\n\nIt was discovered that ConnMan could be made to run into an infinite loop.\nA remote attacker could possibly use this issue to cause ConnMan to\nconsume resources and to stop operating, resulting in a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, and Ubuntu 22.04 LTS. (CVE-2022-23098)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gweb component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32292)\n\nIt was discovered that ConnMan did not properly manage memory under\ncertain circumstances. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-32293)\n\nIt was discovered that ConnMan could be made to write out of bounds via\nthe gdhcp component. A remote attacker could possibly use this issue to\ncause ConnMan to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2023-28488)\n","modified":"2026-02-10T04:43:12Z","published":"2023-07-19T08:45:49Z","related":["UBUNTU-CVE-2021-26675","UBUNTU-CVE-2021-26676","UBUNTU-CVE-2021-33833","UBUNTU-CVE-2022-23096","UBUNTU-CVE-2022-23097","UBUNTU-CVE-2022-23098","UBUNTU-CVE-2022-32292","UBUNTU-CVE-2022-32293","UBUNTU-CVE-2023-28488"],"upstream":["CVE-2021-26675","CVE-2021-26676","CVE-2021-33833","CVE-2022-23096","CVE-2022-23097","CVE-2022-23098","CVE-2022-32292","CVE-2022-32293","CVE-2023-28488","UBUNTU-CVE-2021-26675","UBUNTU-CVE-2021-26676","UBUNTU-CVE-2021-33833","UBUNTU-CVE-2022-23096","UBUNTU-CVE-2022-23097","UBUNTU-CVE-2022-23098","UBUNTU-CVE-2022-32292","UBUNTU-CVE-2022-32293","UBUNTU-CVE-2023-28488"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6236-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-26675"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-26676"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-33833"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-23096"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-23097"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-23098"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-32292"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2022-32293"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-28488"}],"affected":[{"package":{"name":"connman","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/connman@1.21-1.2+deb8u1ubuntu0.1~esm1?arch=source&distro=esm-apps/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21-1.2+deb8u1ubuntu0.1~esm1"}]}],"versions":["1.21-1.2","1.21-1.2build1","1.21-1.2build2","1.21-1.2+deb8u1build0.16.04.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_version":"1.21-1.2+deb8u1ubuntu0.1~esm1","binary_name":"connman"},{"binary_version":"1.21-1.2+deb8u1ubuntu0.1~esm1","binary_name":"connman-dev"},{"binary_version":"1.21-1.2+deb8u1ubuntu0.1~esm1","binary_name":"connman-vpn"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-26676"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23096"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23097"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23098"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32292"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32293"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-28488"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6236-1.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/connman@1.35-6ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35-6ubuntu0.1~esm1"}]}],"versions":["1.35-1","1.35-2","1.35-6"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_version":"1.35-6ubuntu0.1~esm1","binary_name":"connman"},{"binary_version":"1.35-6ubuntu0.1~esm1","binary_name":"connman-dev"},{"binary_version":"1.35-6ubuntu0.1~esm1","binary_name":"connman-vpn"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-26675"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-26676"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-33833"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23096"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23097"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23098"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32292"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32293"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-28488"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6236-1.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/connman@1.36-2ubuntu0.1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2ubuntu0.1"}]}],"versions":["1.36-2build1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"1.36-2ubuntu0.1","binary_name":"connman"},{"binary_version":"1.36-2ubuntu0.1","binary_name":"connman-dev"},{"binary_version":"1.36-2ubuntu0.1","binary_name":"connman-vpn"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:20.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-26675"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-26676"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2021-33833"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23096"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23097"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23098"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32292"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32293"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-28488"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6236-1.json"}},{"package":{"name":"connman","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/connman@1.36-2.3ubuntu0.1?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-2.3ubuntu0.1"}]}],"versions":["1.36-2.2build1","1.36-2.3","1.36-2.3build1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"1.36-2.3ubuntu0.1","binary_name":"connman"},{"binary_version":"1.36-2.3ubuntu0.1","binary_name":"connman-dev"},{"binary_version":"1.36-2.3ubuntu0.1","binary_name":"connman-vpn"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:22.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23096"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23097"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-23098"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32292"},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2022-32293"},{"severity":[{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-28488"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6236-1.json"}}],"schema_version":"1.7.3"}