What’s Vulnerable › Vulnerabilities

CVE-2022-40281

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-08 · updated 2026-06-17
• Weakness: CWE-401

Description

An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). cyassl_connect_step2 in curl/vtls/cyassl.c has a missing X509_free after SSL_get_peer_certificate, leading to information disclosure.

Affected products

• Tizen RT RTOS: 1.0-m1, 1.1, 2.0, 3.0-gbm

References

• https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/curl/vtls/cyassl.c#L545
• https://github.com/Samsung/TizenRT/issues/5626
• https://www.openssl.org/docs/man1.1.1/man3/SSL_get_peer_certificate.html
• https://github.com/Samsung/TizenRT/blob/f8f776dd183246ad8890422c1ee5e8f33ab2aaaf/external/curl/vtls/cyassl.c#L545
• https://github.com/Samsung/TizenRT/issues/5626
• https://www.openssl.org/docs/man1.1.1/man3/SSL_get_peer_certificate.html

Get alerted when CVE-2022-40281 or the next vulnerability affects your stack