Homepage

Incomplete Cleanup The advisory has been revoked - it doesn't affect any version of package edk2  (opens in a new tab)

Threat Intelligence

EPSS
2.52% (84th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-EDK2-2807700
  • published1 Jun 2025
  • disclosed3 May 2022
Report a new vulnerability Found a mistake?

Introduced: 3 May 2022

CVE-2022-1473  (opens in a new tab)
CWE-459  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream edk2 package and not the edk2 package as distributed by Ubuntu.

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).