PatchTheCVEcharm vulnerabilities and fixes
Recent CVEs affecting charm, with upgrade or downgrade steps. 5 tracked.
charm has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-08-05. Highest priority: CVE-2021-37588 (score 41/100).
- CVE-2022-33734 MEDIUM 6.2 UPGRADE Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows at
- CVE-2022-33733 MEDIUM 6.2 UPGRADE Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attac
- CVE-2022-29180 MEDIUM 5.9 UPGRADE A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to acces
- CVE-2021-37588 MEDIUM 5.9 DOWNGRADE In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.
- CVE-2021-37587 MEDIUM 6.5 DOWNGRADE In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.
FAQ
How do I fix charm vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is charm being exploited right now?
None of the tracked charm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which charm CVE should I patch first?
CVE-2021-37588 currently ranks highest (41/100): In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data..