CVE-2022-37434

Name of the Vulnerable Software and Affected Versions zlib versions 1.2.12 and earlier MySQL Server versions 5.7.41 and earlier, 8.0.31 and earlier

Description The issue is related to a heap-based buffer over-read or buffer overflow in the inflate function of the zlib library, specifically in the inflate.c component. This can be triggered by a large gzip header extra field. Only applications that call inflateGetHeader are affected. The exploitation of this issue may allow a remote attacker to execute arbitrary code on the system. It is also noted that some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader.

Recommendations For zlib versions 1.2.12 and earlier, update to a version that includes improved checks to address the heap-based buffer overflow issue. For MySQL Server versions 5.7.41 and earlier, 8.0.31 and earlier, consider restricting access to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the inflateGetHeader function in affected applications until a patch is available.