---
title: "CVE-2022-3620\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2022-3620?format=md
keywords: index, follow
---

# CVE-2022-3620

Publication date 20 October 2022

Last updated 25 August 2025

---

Ubuntu priority

**Negligible**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**9.8 · Critical**

[Score breakdown](https://ubuntu.com/security/CVE-2022-3620?format=md#impact-score)

Toggle side navigation

## Description

A vulnerability was found in Exim and classified as problematic. This issue
affects the function dmarc\_dns\_lookup of the file dmarc.c of the component
DMARC Handler. The manipulation leads to use after free. The attack may be
initiated remotely. The name of the patch is
12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a
patch to fix this issue. The associated identifier of this vulnerability is
VDB-211919.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2022-3620?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| exim4 | 22.10 kinetic | Not affected |
| 22.04 LTS jammy | Not affected |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not affected |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2022-3620?format=md#patch-details)

## Notes

---

### [rodrigo-zaiden](https://launchpad.net/~rodrigo-zaiden)

vulnerable code was added in version 4.95-RC0, with commit
92583637b25b6bde926f9ca6be7b085e5ac8b1e6, so it doesn't
affect releases prior to Jammy.
DMARC support (EXPERIMENTAL\_DMARC or SUPPORT\_DMARC flags)
is not built by default in Debian, so this issue is
negligible in Ubuntu.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| exim4 | * Upstream:   [12fb384](https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

9.8 · Critical

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 9.8 · Critical |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3620)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-3620)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-3620)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2022-3620)

### Other references

* <https://vuldb.com/?id.211919>
* <https://github.com/Exim/exim/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445>
* <https://www.cve.org/CVERecord?id=CVE-2022-3620>