« Volver al listado

CVE-2026-22697

Estado: AnalizadaAlta (7.5)—

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib’s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service.

Leer descripción completaMostrar menos

The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Buffer overflow en servicio remoto (KMC) accesible sin autenticación (PR:N). AV:N/AC:L indica T1190. Heap overflow causa crash (A:H→DoS) y potencial RCE; impactos: negación de servicio primario, ejecución de código secundaria según 'potentially code execution under certain conditions'.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementFilter Network TrafficVulnerability ScanningRestrict Web-Based ContentNetwork SegmentationLimit Software Installation

Tecnologías afectadas (1)

Nasa — Cryptolib

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22697",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22697",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-13T21:48:35.288004Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nasa",
          "product": "CryptoLib",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-10T01:16:19.160",
  "references": [
    {
      "url": "https://github.com/nasa/CryptoLib/releases/tag/v1.4.3",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nasa/CryptoLib/security/advisories/GHSA-qjx3-83jh-2jc4",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. Prior to version 1.4.3, CryptoLib’s KMC crypto service integration is vulnerable to a heap buffer overflow when decoding Base64-encoded ciphertext/cleartext fields returned by the KMC service. The decode destination buffer is sized using an expected output length (len_data_out), but the Base64 decoder writes output based on the actual Base64 input length and does not enforce any destination size limit. An oversized Base64 string in the KMC JSON response can cause out-of-bounds writes on the heap, resulting in process crash and potentially code execution under certain conditions. This issue has been patched in version 1.4.3."
    },
    {
      "lang": "es",
      "value": "CryptoLib proporciona una solución únicamente de software utilizando el Protocolo de Seguridad de Enlace de Datos Espaciales CCSDS - Procedimientos Extendidos (SDLS-EP) para asegurar las comunicaciones entre una nave espacial que ejecuta el Sistema de Vuelo central (cFS) y una estación terrestre. Antes de la versión 1.4.3, la integración del servicio criptográfico KMC de CryptoLib es vulnerable a un desbordamiento de búfer de pila al decodificar campos de texto cifrado/texto claro codificados en Base64 devueltos por el servicio KMC. El búfer de destino de decodificación se dimensiona utilizando una longitud de salida esperada (len_data_out), pero el decodificador Base64 escribe la salida basándose en la longitud real de la entrada Base64 y no impone ningún límite de tamaño de destino. Una cadena Base64 sobredimensionada en la respuesta JSON del KMC puede causar escrituras fuera de límites en la pila, lo que resulta en un fallo del proceso y potencialmente la ejecución de código bajo ciertas condiciones. Este problema ha sido parcheado en la versión 1.4.3."
    }
  ],
  "lastModified": "2026-06-17T10:20:15.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nasa:cryptolib:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE1BE91E-2901-42AF-BC66-762CFA7A2582",
              "versionEndExcluding": "1.4.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}