CVE-2022-32739

What it actually does

The vulnerability causes the software release number to be included in ICS calendar files generated when the DisableBanner configuration is disabled and a calendar is shared via public URL, resulting in unintended version information disclosure over the network.

Why it matters to the business

Attackers can more easily identify the exact software version in use, allowing them to select targeted exploits against the installation and increasing the risk of successful compromise in environments where public calendar sharing is enabled.

How an attack unfolds

An attacker accesses a publicly shared calendar URL, retrieves the generated ICS file, and extracts the embedded release number to determine the precise software version and plan follow-on attacks.

How to fix it

Upgrade sileht/bird-lg (GIT) to commit ef6b32c527478fefe7a4436e10b96ee28ed5b308 or later; if calendar sharing is not required, disable public URL access or re-enable the DisableBanner configuration.

How to confirm the fix worked

Confirm the deployed commit hash is ef6b32c527478fefe7a4436e10b96ee28ed5b308 or newer, generate a test ICS file from a public calendar URL with DisableBanner disabled, and verify that no release number appears in the output.

Typical attack path

1. Identify a publicly accessible calendar sharing URL in the target deployment
2. Request the ICS file without authentication
3. Parse the ICS content to extract the release number string
4. Map the version to known vulnerabilities for further exploitation

How to detect it

Review web server access logs for repeated requests to public calendar URLs and inspect generated ICS files for version strings; no specific threat actor campaigns are associated with this issue.

What your security team should do

• Apply the fixed commit immediately given the public disclosure date and potential for version fingerprinting
• Audit all deployments for enabled public calendar sharing and restrict it to authenticated users only
• Monitor EPSS trend and reassess if exploit maturity increases