CVE-2020-10022

Name of the Vulnerable Software and Affected Versions zephyrproject-rtos zephyr versions 2.1.0 through 2.2.0 and later versions.

Description A malformed JSON payload received from an UpdateHub server may cause memory corruption in the Zephyr OS, potentially leading to a denial of service or code execution.

Recommendations For zephyrproject-rtos zephyr versions 2.1.0 and later, update to a version that includes the fix for this issue. For zephyrproject-rtos zephyr versions 2.2.0 and later, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the reception of JSON payloads from UpdateHub servers until a patch is available.