Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2022-05817

Опубликовано: 27 июн. 2022
Источник: fstec
CVSS3: 7.3
CVSS2: 7.5
EPSS Низкий

Описание

Уязвимость демона HTTP-сервера HTTP Daemon связана с непоследовательной интерпритацией HTTP-запросов при обработке значений строки 'Content-Length'. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии путем отправки специально созданных скрытых HTTP-запросов (атака типа HTTP Request Smuggling)

Вендор

Canonical Ltd.
Novell Inc.
ООО «Ред Софт»
АО «ИВК»
Сообщество свободного программного обеспечения
АО "НППКТ"

Наименование ПО

Ubuntu
Suse Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
openSUSE Tumbleweed
SUSE Linux Enterprise Module for Basesystem
OpenSUSE Leap
РЕД ОС
SUSE Linux Enterprise High Performance Computing
SUSE Manager Proxy
SUSE Manager Server
Suse Linux Enterprise Desktop
Альт 8 СП
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
HTTP Daemon
ОСОН ОСнова Оnyx

Версия ПО

18.04 LTS (Ubuntu)
14.04 ESM (Ubuntu)
12 SP5 (Suse Linux Enterprise Server)
12 SP5 (SUSE Linux Enterprise Server for SAP Applications)
- (openSUSE Tumbleweed)
20.04 LTS (Ubuntu)
15 SP3 (SUSE Linux Enterprise Module for Basesystem)
16.04 ESM (Ubuntu)
15.3 (OpenSUSE Leap)
7.3 (РЕД ОС)
15.4 (OpenSUSE Leap)
15 SP3 (SUSE Linux Enterprise High Performance Computing)
15 SP3 (Suse Linux Enterprise Server)
15 SP3 (SUSE Linux Enterprise Server for SAP Applications)
4.2 (SUSE Manager Proxy)
4.2 (SUSE Manager Server)
15 SP3 (Suse Linux Enterprise Desktop)
- (Альт 8 СП)
15 SP4 (Suse Linux Enterprise Server)
15 SP4 (Suse Linux Enterprise Desktop)
15 SP4 (SUSE Linux Enterprise Server for SAP Applications)
4.2 (SUSE Manager Retail Branch Server)
22.04 LTS (Ubuntu)
4.3 (SUSE Manager Retail Branch Server)
4.3 (SUSE Manager Proxy)
4.3 (SUSE Manager Server)
15 SP4 (SUSE Linux Enterprise High Performance Computing)
7.1 (SUSE Enterprise Storage)
15 SP4 (SUSE Linux Enterprise Module for Basesystem)
до 6.15 (HTTP Daemon)
до 2.6 (ОСОН ОСнова Оnyx)

Тип ПО

Операционная система
Прикладное ПО информационных систем
Сетевое средство

Операционные системы и аппаратные платформы

Canonical Ltd. Ubuntu 18.04 LTS
Canonical Ltd. Ubuntu 14.04 ESM
Novell Inc. Suse Linux Enterprise Server 12 SP5
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5
Canonical Ltd. Ubuntu 20.04 LTS
Canonical Ltd. Ubuntu 16.04 ESM
Novell Inc. OpenSUSE Leap 15.3
ООО «Ред Софт» РЕД ОС 7.3
Novell Inc. OpenSUSE Leap 15.4
Novell Inc. Suse Linux Enterprise Server 15 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP3
Novell Inc. Suse Linux Enterprise Desktop 15 SP3
АО «ИВК» Альт 8 СП -
Novell Inc. Suse Linux Enterprise Server 15 SP4
Novell Inc. Suse Linux Enterprise Desktop 15 SP4
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 15 SP4
Canonical Ltd. Ubuntu 22.04 LTS
АО "НППКТ" ОСОН ОСнова Оnyx до 2.6

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,5)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,3)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для HTTP Daemon:
https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0
https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2
https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2022-31081.html
Для Ubuntu:
https://ubuntu.com/security/notices/USN-5520-1
https://ubuntu.com/security/notices/USN-5520-2
Для ОСОН ОСнова Оnyx:
Обновление программного обеспечения libhttp-daemon-perl до версии 6.14-2
Для ОС Альт 8 СП (релиз 10): установка обновления из публичного репозитория программного средства
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 60%
0.00404
Низкий

7.3 High

CVSS3

7.5 High

CVSS2

Связанные уязвимости

CVSS3: 7.3
redos
11 месяцев назад

Уязвимость perl-HTTP-Daemon

CVSS3: 7.3
ubuntu
около 3 лет назад

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be ...

CVSS3: 6.5
redhat
около 3 лет назад

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be ...

CVSS3: 7.3
nvd
около 3 лет назад

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rej

CVSS3: 7.3
debian
около 3 лет назад

HTTP::Daemon is a simple http server class written in perl. Versions p ...

EPSS

Процентиль: 60%
0.00404
Низкий

7.3 High

CVSS3

7.5 High

CVSS2