CVE-2022-45938: Security Vulnerability Report

Comcast Security: Responsible Disclosure Policy****Responsible Disclosure Philosophy

Comcast believes effective responsible disclosure of security vulnerabilities requires mutual trust, respect, transparency and common good between Comcast and Security Researchers. Together, our vigilant expertise promotes the continued security and privacy of Comcast customers, products, and services.

Security Researchers

Comcast accepts vulnerability reports from all sources such as independent security researchers, industry partners, vendors, customers and consultants. Comcast defines a security vulnerability as an unintended weakness or exposure that could be used to compromise the integrity, availability or confidentiality of our products and services.

Our Commitment to Researchers

• Trust. We maintain trust and confidentiality in our professional exchanges with security researchers.
• Respect. We treat all researchers with respect and recognize your contribution for keeping our customers safe and secure.
• Transparency. We will work with you to validate and remediate reported vulnerabilities in accordance with our commitment to security and privacy.
• Common Good. We investigate and remediate issues in a manner consistent with protecting the safety and security of those potentially affected by a reported vulnerability.

What We Ask of Researchers

• Trust. We request that you communicate about potential vulnerabilities in a responsible manner, providing sufficient time and information for our team to validate and address potential issues.
• Respect. We request that researchers make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data during security testing.
• Transparency. We request that researchers provide the technical details and background necessary for our team to identify and validate reported issues, using the form below.
• Common Good. We request that researchers act for the common good, protecting user privacy and security by refraining from publicly disclosing unverified vulnerabilities until our team has had time to validate and address reported issues.

Vulnerability Reporting

Comcast recommends that security researchers share the details of any suspected vulnerabilities using the web form below. The Comcast Security team will acknowledge receipt of each vulnerability report, conduct a thorough investigation, and then take appropriate action for resolution. To encrypt a submission via email, use the public key provided on this page.

Submission Form powered by Bugcrowd****Security Researcher Hall of Fame

Comcast would like to thank the following researchers for their responsible disclosures, which were in scope for our Vulnerability Disclosure Program:

Researcher

Profile

Joseph Thacker

bugcrowd.com/rez0

Farhan Kalsekar

twitter.com/frrhnn

Ben Chinoy

linkedin.com/in/ben-chinoy-55483736

Igor Barshteyn

linkedin.com/in/igorbarshteyn

David Calligaris

Mukesh Kumar

bugcrowd.com/theserpent

Osama Ansari

twitter.com/ansariosama10

Mrpeuch

bugcrowd.com/mrpeuch

Cameron Dawe

twitter.com/spam404online

Ahmed Alwardani

linkedin.com/in/alwardani

Carlos Eduardo Santiago

linkedin.com/in/carlos-eduardo-santiago-06945b18/

Thejus Krishnan

twitter.com/Tjz_kr1

Christopher Schneider

linkedin.com/in/christopherschneidersec

Researcher

Profile

Mrpeuch

bugcrowd.com/mrpeuch

Sameer Phad

twitter.com/sameerphad72

Benson Cheek

twitter.com/bmdc25

Michael Skelton

twitter.com/codingo_

Samet SAHIN

twitter.com/sametsahinnet

Noah

twitter.com/thesubtlety

Er Quan

sg.linkedin.com/in/eqbang

Ali Razzaq

twitter.com/alirazzaq_

Researcher

Profile

Alex Boese

https://www.linkedin.com/in/alexboese

Sean Durkin

linkedin.com/in/seanrdurkin

Justin Calmus

linkedin.com/in/jcalmus/

whatasec

twitter.com/whatasec

FogMarks.com

twitter.com/fogmarks

Shahar Albeck

twitter.com/l33terally

Maxwell Pereira

linkedin.com/in/maxwellpereira

Yash Mehta

linkedin.com/in/1yashm

Hamza Grindi

hackerone.com/hamza_g

Daniel Zhang

bugcrowd.com/danielzhang

Devansh Batham (infoziant Labs)

twitter.com/devanshwolf

Cody Zacharias

linkedin.com/in/codyzacharias

Ashish Kunwar

bugcrowd.com/dorkerdevil

Koen Rouwhorst

linkedin.com/in/koenrouwhorst/

Vineet Kumar

Encryption

Alternatively, you may send vulnerability submissions or questions to the Comcast Security Team via email to [email protected]. Encryption key provided below:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGBeISUBEAC0HSrden41OvU/JV6TbyZ0vCrQrx2keOsCeX0I524BrQbQP/3d YLfDCZjaq0U2ZLwV+A/Mu8O+LEqKffOqyBEVCUVyh1Zjkmkp+Jk/FomaEwGj2KYD G5iyw0j+Cuu9S1HMrKozOJCGuJ3Aq9qn38n8vLy3spsnCIiKQpJMnYBAzKwDLuO+ 2JrQ7vpZ2ytW63mLcouQ9cKmA4W5OlD6gm7Fd63KYF7g+toxHw22ZXDT01fqAA9n zIOyoLZQcLMXAfddQuRklji65/cGhtPIVsBs2ZV9xJnn50VVvfc14P22nK9bZgf0 XoeBAL8LB+f7VIVTD/+X5ToA1BiFATbivxX3dZZwzGBMxROyFpMU2RCXwZj0NItj /YfO4DnG2K77WF9XKpeqt+D/KaV9WXd91GxTJgbjY7GRsGPEjLyGqAAZAvmBdO1p +Bc2cxIiQ9yhceVfreUOdNPwp5O1p9Z8NN48cM6J1mrm4473OqIm71BoWaoh2+wn UpwPtvQ95ZFSrPrDa9MNRieGB4/zGQkDCQegOFFD1uVF477ft8I0tNUaSc/Ixwpp Gj9ijY69Ra4I66CJGtGQ79VZ1xpML8RVROTKdbh9hvqBS1/pJiGBUtiPNg5iubvS PwmLcwowA6nRU3EYj+jMmje1pEHmcgcu7oMzaWH93EdFEzl1Av4kjnC4jwARAQAB tF1Db21jYXN0IFByb2R1Y3QgU2VjdXJpdHkgSW5jaWRlbnQgUmVzcG9uc2UgVGVh bSAoUFNJUlQpIDxzZWN1cml0eWRlZmVjdHJlcG9ydGluZ0Bjb21jYXN0LmNvbT6J Ak4EEwEIADgWIQQ/lltQ7aGclNQZCAinTPOe0kWI8gUCYF4hJQIbAwULCQgHAgYV CgkICwIEFgIDAQIeAQIXgAAKCRCnTPOe0kWI8uIOD/sHfn9sMRQYlzcCntyXA/jy mgkh2IdwNxOw5wG48m771AR1VFNr54dY3AgK74xPcFsiT6FUyMKrp72weyv/7/BW vOh3M2ff9VaZjWeN/L96I3mfHkzoyQ19vDhtc9MtXnZrybV8SvWFyOO0Ziu6gNSl ygBo4GjBIkAL32uRmqcyoUZTJJdDpLAM/m76lodEQ/ekC5JmJADOdK+BmVh4rJ4H bx8Uu+SseTQ0XjccqKYu+T4OxtgqmCLc2gvLpJH72XWDU0iKOyFW1BL4rqh2RTCj rn5xEYm3RBVfHjN+z/REuyNwcxcR0dqk5h9903XsYELIQO/tHyBRGxX3HKs+R0Sk GYLe/scyoETE91DnZSPrt3c3SrwOur5E8V0yNhGbADYwD6CVVPvIZcdUjusXFdjD KT/JfSU6MCqAD70CwBTIUcEobw22C0sGQuEO5ayC3EtdbYvcoAMKU1+TyYzJFPif GeQ+KU1Q94Mnc3uh9/nTL+w54IcYm4SzkTGOYqTQPYgdnlkV+kx14iBLfI54QmZS YrfY1cqb564W8bDtis9JLRm3yJ2a2q8bCadkuSGpJ3dM6cAYXtTSQeSTiWt3L3Ri Au6i2iimUF+TxMfIxUdwRsApTOBBGIDY4EPzWSFH8+Cb3SXYBAm6Bv5KXSplnEbg v5z7jnChE2TtUDQ6LM7bF7kCDQRgXiElARAAuPg110eFje7iJ+CWF3YPYlWydzt4 3syp0tzD+FNx22eiFxJufLONxSLBjpyFcRxixsQtGF1DV/88Ois1brDBkp7kAdpd X1c+ESBmqOXTsSy6/YCeD9kChzViS6T+9qUbJLLPG0GFclOrheLumh1RrrO5XRQd j+xcF0g/3oYZrWwUFfGHg0RxFp2zi+GODK5Ab7CSsDUkZxDCbGY608Mv/hy3W5GP pIty+B/i+J4OZJ4FCzgN8jCHNMftI1vMmWFbO4dljWboDf1rNxrbYSdMTCIaSYbi Gp+K+iucGabhDjo6mCAcjMM9wn/Mo+E/WeRrqHQmYqrSMfrCU/9xZHsbMlIkK+Xj CceWmUSNMVhm22qxn6AlQUI9h2jYV4wyYw4uD4vEnkUZiGM//DWCMX6YNNFfU6f/ 4YhIuctq7cv4RHWLW3/c1zHJsNq8r6uaTdYEtYBYWQvYvNj9/aNkuDnjA/TMHEH/ amND500m8HOEs7X6nHLsai/9ZpxUuAlgq+4UVKOX+qG5P+SDbeSUJEqBaCfbC8zE SQ5ngSro5et+bOsiC59JfwA/iRlSL5IfJpThIHMoI7SPWvwlQxBwLlfkiDBv0k0e w5uw07VDc32WVWg9OIMMwUL5NeMoX535Y6WEZYDPRSTMVy3doUcze+bdWnwzPLbd e/DyWjjHzoCwh00AEQEAAYkCNgQYAQgAIBYhBD+WW1DtoZyU1BkICKdM857SRYjy BQJgXiElAhsMAAoJEKdM857SRYjy/ZcP/AgQ611ciptmamHlYcwq3EsRTa050UN/ 9/Tw8KzPG5zRIrfgfJKJ90GMOtrAxGCj4Ysbm+oJpRB+M59TOBI+aFw+k4TO4LCq oaFPPHwLN9pg0Rg5nYnqm0rzCQHYC5iZYbTGnb5GxBW5wLCe+WtkUVLnoEShNEJU +Atqs5V34ZmpfzsEqCRlg9vJhodnpwZpYv5iGlqSEL4llfgRfga5P9VKBwjPCklx A3A6AXOxXDj1g1mR5DDOfE74aOIS6sB+jN7Fe4wBdF+SCgtuiOk0fr+D8xbMkGRy OrsUZZLnu534YreoUGxFnPp4svNp7HFnb1qCUnNdnDwPyeNsL1TKN3C6dqieNlbw og60fXUIZ5knYHiHm5BSEfzgVoHrykzq9DUT/fa9xLAxP381chLGTU9jSRDPIPeY 7YuLDh0pgCqoqQO/QkzsJPE8JyBke7iLFviczlhh31nH9V4dn23c3G5EWgyL3n5u S2lEuH14ieCh3Ql4lKD/hNhYEr3DTvrM3OKOgsGFKB+KMmorsT9ePWs2J6gA4dMA MQbCp6sSvxSM/lGKCZSgyRsuuWoWKRTqT7MhIhmea3AbyG5rzqLqw+aMGRiY3Uuc 6OwtW8m2ieGl4AyTUvfsIg+iE+al8FXAEFoN2rxtUFZvc8elpvSe6qkLxEAaSt3O g6h+SklSCYsx =Lfos -----END PGP PUBLIC KEY BLOCK-----