CVE-2022-1249

A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.

Red Hat Enterprise Linux 7, 8, and 9 are not affected, because vulnerable code is introduced upstream with pesign v114, whereas, Red Hat ships pesign v113 and lower.

Red Hat Product Security has rated this issue as having a Low security impact. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.