CVE catalog

CVE-2022-2211

guestfs-tools: CVE-2022-2211

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Jun 24, 2022, 1:43:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.97% · Oct 25, 2026

A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or malicious actor.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libguestfs	sid	`1:1.60.1-2`	fixed
Debian	libguestfs	forky	`1:1.60.1-2`	fixed
Debian	libguestfs	trixie	`1:1.54.1-2+deb13u1`	fixed
Debian	libguestfs	bookworm	`1:1.48.6-2`	fixed
Debian	guestfs-tools	sid	`1.56.1-1`	fixed
Debian	guestfs-tools	forky	`1.56.1-1`	fixed
Debian	guestfs-tools	trixie	`1.52.3-1`	fixed
Debian	guestfs-tools	bookworm	`1.48.2-1+deb12u1`	fixed
Debian	guestfs-tools	bookworm-security	`1.48.2-1+deb12u1`	fixed
Opensuse	libguestfs	tumbleweed	`1.48.3-3.1`	fixed
Suse	virt-v2v	linux enterprise module for server applications 15 sp4	`1.44.2-150400.3.3.1`	fixed
Opensuse	virt-v2v	leap 15.4	`1.44.2-150400.3.3.1`	fixed
Suse	libguestfs	linux enterprise module for development tools 15 sp4	`1.44.2-150400.3.3.1`	fixed
Suse	libguestfs	linux enterprise module for server applications 15 sp4	`1.44.2-150400.3.3.1`	fixed
Opensuse	libguestfs	leap 15.4	`1.44.2-150400.3.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libguestfs	source	sid	`1:1.46.2-1`	not yet assigned	Not reported	Not reported
Debian	libguestfs	source	forky	`1:1.46.2-1`	not yet assigned	Not reported	Not reported
Debian	libguestfs	source	trixie	`1:1.46.2-1`	not yet assigned	Not reported	Not reported
Debian	libguestfs	source	bookworm	`1:1.46.2-1`	not yet assigned	Not reported	Not reported
Debian	guestfs-tools	source	sid	`1.48.3-4`	not yet assigned	Not reported	[1014764]
Debian	guestfs-tools	source	forky	`1.48.3-4`	not yet assigned	Not reported	[1014764]
Debian	guestfs-tools	source	trixie	`1.48.3-4`	not yet assigned	Not reported	[1014764]
Debian	guestfs-tools	source	bookworm	`1.48.2-1+deb12u1`	not yet assigned	Not reported	[1014764]
Opensuse	libguestfs	rpm	tumbleweed	`1.48.3-3.1`	Not reported	OPENSUSE-SU-2024:12165-1	Not reported
Suse	virt-v2v	rpm	linux enterprise module for server applications 15 sp4	`1.44.2-150400.3.3.1`	Not reported	SUSE-SU-2022:4308-1	Not reported
Opensuse	virt-v2v	rpm	leap 15.4	`1.44.2-150400.3.3.1`	Not reported	SUSE-SU-2022:4308-1	Not reported
Suse	libguestfs	rpm	linux enterprise module for development tools 15 sp4	`1.44.2-150400.3.3.1`	Not reported	SUSE-SU-2022:2581-1	Not reported
Suse	libguestfs	rpm	linux enterprise module for server applications 15 sp4	`1.44.2-150400.3.3.1`	Not reported	SUSE-SU-2022:2581-1	Not reported
Opensuse	libguestfs	rpm	leap 15.4	`1.44.2-150400.3.3.1`	Not reported	SUSE-SU-2022:2581-1	Not reported

[Debian bug #1014764]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libguestfs0]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-appliance]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-bash-completion]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfsd]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-devel]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-inspect-icons]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-man-pages-ja]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-man-pages-uk]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-rescue]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-rsync]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-winsupport]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[libguestfs-xfs]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[lua-libguestfs]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[ocaml-libguestfs]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[ocaml-libguestfs-devel]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[perl-Sys-Guestfs]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[python3-libguestfs]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed
[rubygem-libguestfs]Unknown
Source package: [libguestfs]
Details (1)
- 1.60.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.48.3-3.1
  Version impact unknown
  dsa · libguestfs · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[gir1.2-guestfs-1.0]Fixed
Source package: [libguestfs]
Details (2)
- 1:1.48.6-2 · amd64 · bookworm
  Fixed · Fixed: 1:1.46.2-1
  dsa · libguestfs · debian · bookworm
- 1:1.48.6-2 · arm64 · bookworm
  Fixed · Fixed: 1:1.46.2-1
  dsa · libguestfs · debian · bookworm
[golang-guestfs-dev]Fixed
Source package: [libguestfs]
Details (2)
- 1:1.48.6-2 · all · bookworm
  Fixed · Fixed: 1:1.46.2-1
  dsa · libguestfs · debian · bookworm
- 1:1.48.6-2 · all · bookworm
  Fixed · Fixed: 1:1.46.2-1
  dsa · libguestfs · debian · bookworm

Next results

Observed: Oct 23, 2026, 6:24:20 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]