critical9.1
CVE-2022-27818
Insecure temporary file usage in SWHKD
Impact
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | Simple-Wayland-HotKey-Daemon | < 1.2.0 | 1.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Waycrate | Swhkd | Version 1.1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/04/14/1
- https://github.com/waycrate/swhkd/commit/f70b99dd575fab79d8a942111a6980431f006818
- https://github.com/waycrate/swhkd/releases
- https://github.com/advisories/GHSA-r3r5-jhw6-4634
- https://nvd.nist.gov/vuln/detail/CVE-2022-27818
- https://github.com/waycrate/swhkd/releases/tag/1.2.0