CVE-2023-27371

Published: 28/02/2023 Updated: 31/03/2023

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 0

GNU libmicrohttpd prior to 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an malicious user to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu libmicrohttpd

Synopsis Moderate: libmicrohttpd security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for libmicrohttpd is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as ...

Synopsis Moderate: libmicrohttpd security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for libmicrohttpd is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as ...

Synopsis Moderate: libmicrohttpd security update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for libmicrohttpd is now available for Red Hat Enterprise Linux 88 Extended Update SupportRed Hat Product Securit ...

GNU libmicrohttpd before 0976 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessorc MHD_create_post_processor() method This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assumin ...

DescriptionThe MITRE CVE dictionary describes this issue as: GNU libmicrohttpd before 0976 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessorc MHD_create_post_processor() method This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' b ...

Critical Infrastructure Sectors: Critical Manufacturing

CWE-125 https://github.com/0xhebi/CVEs/tree/main/GNU%20Libmicrohttpd https://git.gnunet.org/libmicrohttpd.git/commit/?id=6d6846e20bfdf4b3eb1b592c97520a532f724238 https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html https://lists.debian.org/debian-lts-announce/2023/03/msg00029.html https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:6566 https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10 https://alas.aws.amazon.com/AL2/ALAS-2023-2135.html

CVE-2023-27371

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect