{"id":"CVE-2022-1289","summary":"tildearrow Furnace Incomplete Fix CVE-2022-1211 denial of service","details":"A denial of service vulnerability was found in tildearrow Furnace. It has been classified as problematic. This is due to an incomplete fix of CVE-2022-1211. It is possible to initiate the attack remotely but it requires user interaction. The issue got fixed with the patch 0eb02422d5161767e9983bdaa5c429762d3477ce.","modified":"2026-08-12T13:00:08.462986Z","published":"2022-04-10T15:15:15Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-404"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1289.json"},"references":[{"type":"WEB","url":"https://vuldb.com/?id.196755"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1289.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1289"},{"type":"REPORT","url":"https://github.com/tildearrow/furnace/issues/325#issuecomment-1094139655"},{"type":"FIX","url":"https://github.com/tildearrow/furnace/commit/0eb02422d5161767e9983bdaa5c429762d3477ce"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tildearrow/furnace","events":[{"introduced":"217e42471b3ac9a8b9677d501b880642df93fa69"},{"fixed":"0eb02422d5161767e9983bdaa5c429762d3477ce"}],"database_specific":{"cpe":["cpe:2.3:a:tildearrow:furnace:0.2:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.2.1:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.2.2:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.3:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.3.1:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.1:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.2:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.3:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.4:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.5:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.5:real:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.6:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.4.7:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.1:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.2:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.3:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.4:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.5:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.6:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.7:-:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.7:pre4:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.5.8:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:0.6:pre0:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev5:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev6:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev7:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev8:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev9:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev10:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev62:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev63:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev64:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev65:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev66:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev67:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev68:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev69:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev70:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev71:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev72:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev73:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev75:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev76:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev77:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev78:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev79:*:*:*:*:*:*:*","cpe:2.3:a:tildearrow:furnace:dev80:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.2"},{"last_affected":"0.2"},{"introduced":"0.2.1"},{"last_affected":"0.2.1"},{"introduced":"0.2.2"},{"last_affected":"0.2.2"},{"introduced":"0.3"},{"last_affected":"0.3"},{"introduced":"0.3.1"},{"last_affected":"0.3.1"},{"introduced":"0.4"},{"last_affected":"0.4"},{"introduced":"0.4.1"},{"last_affected":"0.4.1"},{"introduced":"0.4.2"},{"last_affected":"0.4.2"},{"introduced":"0.4.3"},{"last_affected":"0.4.3"},{"introduced":"0.4.4"},{"last_affected":"0.4.4"},{"introduced":"0.4.5"},{"last_affected":"0.4.5"},{"introduced":"0.4.5-real"},{"last_affected":"0.4.5-real"},{"introduced":"0.4.6"},{"last_affected":"0.4.6"},{"introduced":"0.4.7"},{"last_affected":"0.4.7"},{"introduced":"0.5"},{"last_affected":"0.5"},{"introduced":"0.5.1"},{"last_affected":"0.5.1"},{"introduced":"0.5.2"},{"last_affected":"0.5.2"},{"introduced":"0.5.3"},{"last_affected":"0.5.3"},{"introduced":"0.5.4"},{"last_affected":"0.5.4"},{"introduced":"0.5.5"},{"last_affected":"0.5.5"},{"introduced":"0.5.6"},{"last_affected":"0.5.6"},{"introduced":"0.5.7-NA"},{"last_affected":"0.5.7-NA"},{"introduced":"0.5.7-pre4"},{"last_affected":"0.5.7-pre4"},{"introduced":"0.5.8"},{"last_affected":"0.5.8"},{"introduced":"0.6-pre0"},{"last_affected":"0.6-pre0"},{"introduced":"dev5"},{"last_affected":"dev5"},{"introduced":"dev6"},{"last_affected":"dev6"},{"introduced":"dev7"},{"last_affected":"dev7"},{"introduced":"dev8"},{"last_affected":"dev8"},{"introduced":"dev9"},{"last_affected":"dev9"},{"introduced":"dev10"},{"last_affected":"dev10"},{"introduced":"dev62"},{"last_affected":"dev62"},{"introduced":"dev63"},{"last_affected":"dev63"},{"introduced":"dev64"},{"last_affected":"dev64"},{"introduced":"dev65"},{"last_affected":"dev65"},{"introduced":"dev66"},{"last_affected":"dev66"},{"introduced":"dev67"},{"last_affected":"dev67"},{"introduced":"dev68"},{"last_affected":"dev68"},{"introduced":"dev69"},{"last_affected":"dev69"},{"introduced":"dev70"},{"last_affected":"dev70"},{"introduced":"dev71"},{"last_affected":"dev71"},{"introduced":"dev72"},{"last_affected":"dev72"},{"introduced":"dev73"},{"last_affected":"dev73"},{"introduced":"dev75"},{"last_affected":"dev75"},{"introduced":"dev76"},{"last_affected":"dev76"},{"introduced":"dev77"},{"last_affected":"dev77"},{"introduced":"dev78"},{"last_affected":"dev78"},{"introduced":"dev79"},{"last_affected":"dev79"},{"introduced":"dev80"},{"last_affected":"dev80"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.2","0.2.1","0.2.2","0.3","0.3.1","0.4","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7-NA","0.5.7-pre4","0.5.8","0.6-pre0","dev10","dev5","dev6","dev62","dev63","dev64","dev65","dev66","dev67","dev68","dev69","dev7","dev70","dev71","dev72","dev73","dev75","dev76","dev77","dev78","dev79","dev8","dev80","dev9","v0.6pre0","v0.5.7","v0.5.7pre4","v0.5.6","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5","v0.4.6","v0.4.5-real","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4","v0.3.1","v0.3","v0.2.2","v0.2.1","v0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1289.json","vanir_signatures_modified":"2026-08-12T13:00:08Z","vanir_signatures":[{"source":"https://github.com/tildearrow/furnace/commit/0eb02422d5161767e9983bdaa5c429762d3477ce","target":{"file":"src/gui/pattern.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["335054832721819695341258929487485254091","188167164482528443823020661433853272003","275695170689737141780568725748329210444","229775994306794305861732485281585947710","205542306335405924399593836027670631170","5527374082439882929407294290345732572","14205804872781347412031128190549890686","224527381082166424050347205262292829280","299615791772188005475367469667676677627","35291682120878028074562167328046806675","229305566675741677860294076858399250525","191678615460417363471654598511070760145","94755691338511321975974293456769700443","338229083817740201723464914651087997401","231427078726831481721968362667948769222","180429986184618552289062435907467840408","178998884727283178971979818122113358261","176855138969740191773339550628523287765","292788389037357391129479104853790042689","145057607930188924730787717210684651415","12026866681922850118580940562993504400","138193661692865688140163686713591072773","247988030675059336927251877141400701104","202937378793698949818660023902147530893"]},"id":"CVE-2022-1289-1ce81ad5","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/tildearrow/furnace/commit/0eb02422d5161767e9983bdaa5c429762d3477ce","target":{"file":"src/gui/pattern.cpp","function":"FurnaceGUI::patternRow"},"deprecated":false,"digest":{"function_hash":"209561055361738806669877998052791832808","length":12437},"id":"CVE-2022-1289-b057369c"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}]}