Bug 2174313 (CVE-2023-27371) - CVE-2023-27371 libmicrohttpd: remote DoS
Summary: CVE-2023-27371 libmicrohttpd: remote DoS
Keywords:
Status: NEW
Alias: CVE-2023-27371
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2174318 2174320 2174317 2174319 2174639 2174640
Blocks: 2174315
TreeView+ depends on / blocked
 
Reported: 2023-03-01 06:15 UTC by Avinash Hanwate
Modified: 2024-03-05 16:23 UTC (History)
1 user (show)

Fixed In Version: libmicrohttpd 0.9.76
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds flaw was found in GNU's libmicrohttpd due to improper parsing of a multipart/form-data boundary in the MHD_create_post_processor() method in postprocessor.c. This flaw allows an attacker to remotely send a malicious HTTP POST packet that includes one or more ‘\0’ bytes in a multipart/form-data boundary field, which, assuming a specific heap layout, will result in an out-of-bounds read and a crash in the find_boundary() function, causing a denial of service.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:6566 0 None None None 2023-11-07 08:19:22 UTC
Red Hat Product Errata RHSA-2023:7090 0 None None None 2023-11-14 15:21:41 UTC
Red Hat Product Errata RHSA-2024:0584 0 None None None 2024-01-30 13:24:53 UTC
Red Hat Product Errata RHSA-2024:1109 0 None None None 2024-03-05 16:23:10 UTC

Description Avinash Hanwate 2023-03-01 06:15:09 UTC 
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

https://github.com/0xhebi/CVEs/tree/main/GNU%20Libmicrohttpd
https://git.gnunet.org/libmicrohttpd.git/commit/?id=6d6846e20bfdf4b3eb1b592c97520a532f724238
https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html
Comment 1 TEJ RATHI 2023-03-01 06:35:56 UTC 
Created libmicrohttpd tracking bugs for this issue:

Affects: fedora-all [bug 2174317]


Created mingw-libmicrohttpd tracking bugs for this issue:

Affects: fedora-all [bug 2174319]


Created proxysql tracking bugs for this issue:

Affects: epel-all [bug 2174318]
Affects: fedora-all [bug 2174320]
Comment 4 errata-xmlrpc 2023-11-07 08:19:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6566 https://access.redhat.com/errata/RHSA-2023:6566
Comment 5 errata-xmlrpc 2023-11-14 15:21:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7090 https://access.redhat.com/errata/RHSA-2023:7090
Comment 7 errata-xmlrpc 2024-01-30 13:24:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0584 https://access.redhat.com/errata/RHSA-2024:0584
Comment 8 errata-xmlrpc 2024-03-05 16:23:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:1109 https://access.redhat.com/errata/RHSA-2024:1109
Note You need to log in before you can comment on or make changes to this bug.