‹ Volver al listado

CVE-2022-41920

Estado: ModificadaAlta (8.8)—
Gravedad8.8Alta · CVSS 3.1
Probabilidad de explotación0.85 %mayor que el 58 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

Lancet es una librería de utilidad general para el lenguaje de programación go. Las versiones afectadas están sujetas a un problema con Zipslip cuando usan el paquete fileutil para descomprimir archivos. Este problema se solucionó y se incluirá una solución en las versiones 2.1.10 y 1.3.4. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema.

CVSS

Puntuación base
8.8
Versión
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
0.85 %
Percentil entre todas las CVEs puntuadas
58
Fecha de la puntuación
22/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lancet Project — Lancet

CWE

Referencias

Mostrar las 8 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-41920",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-41920",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-22T15:42:50.978547Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "duke-git",
          "product": "lancet",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.3.4"
            },
            {
              "status": "affected",
              "version": ">= 2.0.0, < 2.1.10"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-17T18:15:10.100",
  "references": [
    {
      "url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/duke-git/lancet/issues/62",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/duke-git/lancet/issues/62",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "Lancet es una librería de utilidad general para el lenguaje de programación go. Las versiones afectadas están sujetas a un problema con Zipslip cuando usan el paquete fileutil para descomprimir archivos. Este problema se solucionó y se incluirá una solución en las versiones 2.1.10 y 1.3.4. Se recomienda a los usuarios que actualicen. No se conocen workarounds para este problema."
    }
  ],
  "lastModified": "2026-06-17T05:04:03.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lancet_project:lancet:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1C2AAFE-19C2-489A-942C-6F0F833A348D",
              "versionEndExcluding": "1.3.4"
            },
            {
              "criteria": "cpe:2.3:a:lancet_project:lancet:*:*:*:*:*:go:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B662D915-5AC9-44EA-9E0A-B765A89ACE6E",
              "versionEndExcluding": "2.1.10",
              "versionStartIncluding": "2.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}