Published: 30/03/2023 Updated: 27/05/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). A specially crafted HTTP or TLS packet can lead to arbitrary code execution. An attacker could send a malicious packet to trigger this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sniproxy project sniproxy 0.6.1
sniproxy project sniproxy 0.6.0-2

Debian Bug report logs - #1033752 sniproxy: CVE-2023-25076 Package: src:sniproxy; Maintainer for src:sniproxy is Jan Dittberner <jandd@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 31 Mar 2023 18:39:01 UTC Severity: grave Tags: security, upstream Found in version sniproxy/060-2 ...

An issue has been found in sniproxy, a transparent TLS and HTTP layer 4 proxy with SNI support Due to bad handling of wildcard backend hosts, a crafted HTTP or TLS packet might lead to remote arbitrary code execution For the stable distribution (bullseye), this problem has been fixed in version 060-2+deb11u1 We recommend that you upgrade your ...

Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session.

SNI Proxy Proxies incoming HTTP and TLS connections based on the hostname contained in the initial request of the TCP session This enables HTTPS name-based virtual hosting to separate backend servers without installing the private key on the proxy machine Status: Deprecated 2023-12-13 When I started this project, there wasn't another proxy that filled this niche Now, th

CWE-120 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1731 https://github.com/dlundquist/sniproxy/commit/f8d9a433fe22ab2fa15c00179048ab02ae23d583 https://lists.debian.org/debian-lts-announce/2023/04/msg00030.html https://www.debian.org/security/2023/dsa-5413 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033752 https://nvd.nist.gov https://github.com/dlundquist/sniproxy https://www.debian.org/security/2023/dsa-5413

CVE-2023-25076

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect