CVE-2022-35507

Опубликовано: 04 дек. 2022

Источник: nvd

CVSS3: 7.1

CVSS3: 4.3

EPSS Низкий

Описание

A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3.

Ссылки

https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2
https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
Exploit
Patch
Technical Description
Third Party Advisory
https://git.proxmox.com/?p=pve-http-server.git%3Ba=commitdiff%3Bh=936007ae0241811093155000486da171379c23c2
https://starlabs.sg/blog/2022/12-multiple-vulnerabilites-in-proxmox-ve--proxmox-mail-gateway/
Exploit
Patch
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:proxmox:proxmox_mail_gateway:-:*:*:*:*:*:*:*

cpe:2.3:a:proxmox:pve_http_server:*:*:*:*:*:*:*:*

Версия до 4.1-3 (исключая)

cpe:2.3:a:proxmox:virtual_environment:-:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.01458

Низкий

7.1 High

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-74

Связанные уязвимости

GHSA-xfgp-gpjw-wmqr

CVSS3: 7.1

github

почти 4 года назад

ALT-PU-2022-2181

CVSS3: 9.8

altlinux

больше 4 лет назад

ALT-PU-2022-2181: package `pve-http-server` update to version 4.1.3-alt1

EPSS

Процентиль: 74%

0.01458

Низкий

7.1 High

CVSS3

4.3 Medium

CVSS3

Дефекты

CWE-74