Bug 2174313 (CVE-2023-27371)

Summary: CVE-2023-27371 libmicrohttpd: remote DoS
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: lnykryn
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libmicrohttpd 0.9.76 Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds flaw was found in GNU's libmicrohttpd due to improper parsing of a multipart/form-data boundary in the MHD_create_post_processor() method in postprocessor.c. This flaw allows an attacker to remotely send a malicious HTTP POST packet that includes one or more ‘\0’ bytes in a multipart/form-data boundary field, which, assuming a specific heap layout, will result in an out-of-bounds read and a crash in the find_boundary() function, causing a denial of service.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2174318, 2174320, 2174317, 2174319, 2174639, 2174640    
Bug Blocks: 2174315    

Description Avinash Hanwate 2023-03-01 06:15:09 UTC
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

https://github.com/0xhebi/CVEs/tree/main/GNU%20Libmicrohttpd
https://git.gnunet.org/libmicrohttpd.git/commit/?id=6d6846e20bfdf4b3eb1b592c97520a532f724238
https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html

Comment 1 TEJ RATHI 2023-03-01 06:35:56 UTC
Created libmicrohttpd tracking bugs for this issue:

Affects: fedora-all [bug 2174317]


Created mingw-libmicrohttpd tracking bugs for this issue:

Affects: fedora-all [bug 2174319]


Created proxysql tracking bugs for this issue:

Affects: epel-all [bug 2174318]
Affects: fedora-all [bug 2174320]

Comment 4 errata-xmlrpc 2023-11-07 08:19:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6566 https://access.redhat.com/errata/RHSA-2023:6566

Comment 5 errata-xmlrpc 2023-11-14 15:21:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7090 https://access.redhat.com/errata/RHSA-2023:7090

Comment 7 errata-xmlrpc 2024-01-30 13:24:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0584 https://access.redhat.com/errata/RHSA-2024:0584

Comment 8 errata-xmlrpc 2024-03-05 16:23:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:1109 https://access.redhat.com/errata/RHSA-2024:1109