CVE-2022-24798

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected. This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. There are no known workarounds for this issue.

• CWE-212
• CWE-212

• https://github.com/irrdnet/irrd/commit/0e41bae8d3d27316381a2fc7b466597230e35ec6Patch, Third Party Advisory
• https://github.com/irrdnet/irrd/commit/fdffaf8dd71713f06e99dff417e6aa1e6fa84b70Patch, Third Party Advisory
• https://github.com/irrdnet/irrd/security/advisories/GHSA-cqxx-66wh-8pjwRelease Notes, Third Party Advisory
• https://github.com/irrdnet/irrd/commit/0e41bae8d3d27316381a2fc7b466597230e35ec6Patch, Third Party Advisory
• https://github.com/irrdnet/irrd/commit/fdffaf8dd71713f06e99dff417e6aa1e6fa84b70Patch, Third Party Advisory
• https://github.com/irrdnet/irrd/security/advisories/GHSA-cqxx-66wh-8pjwRelease Notes, Third Party Advisory

Published

Mar 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24793PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1
• CVE-2022-24795yajl-ruby is a C binding to the YAJL JSON parsing and genera…7.5
• CVE-2022-24796RaspberryMatic is a free and open-source operating system fo…9.8
• CVE-2022-24797Pomerium is an identity-aware access proxy. In distributed s…9.1
• CVE-2022-24799wire-webapp is the web application interface for the wire me…6.1
• CVE-2022-2480Use after free in Service Worker API in Google Chrome prior …8.8
• CVE-2022-24800October/System is the system module for October CMS, a self-…8.1
• CVE-2022-24801Twisted is an event-based framework for internet application…8.1
• CVE-2022-24802deepmerge-ts is a typescript library providing functionality…9.8
• CVE-2022-24803Asciidoctor-include-ext is Asciidoctor’s standard include pr…9.8