Описание
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
An out-of-bounds flaw was found in GNU's libmicrohttpd due to improper parsing of a multipart/form-data boundary in the MHD_create_post_processor() method in postprocessor.c. This flaw allows an attacker to remotely send a malicious HTTP POST packet that includes one or more ‘\0’ bytes in a multipart/form-data boundary field, which, assuming a specific heap layout, will result in an out-of-bounds read and a crash in the find_boundary() function, causing a denial of service.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | libmicrohttpd | Out of support scope | ||
| Red Hat Enterprise Linux 7 | libmicrohttpd | Out of support scope | ||
| Red Hat Enterprise Linux 8 | libmicrohttpd | Fixed | RHSA-2023:7090 | 14.11.2023 |
| Red Hat Enterprise Linux 8.6 Extended Update Support | libmicrohttpd | Fixed | RHSA-2024:1109 | 05.03.2024 |
| Red Hat Enterprise Linux 8.8 Extended Update Support | libmicrohttpd | Fixed | RHSA-2024:0584 | 30.01.2024 |
| Red Hat Enterprise Linux 9 | libmicrohttpd | Fixed | RHSA-2023:6566 | 07.11.2023 |
Показывать по
Дополнительная информация
Статус:
5.9 Medium
CVSS3
Связанные уязвимости
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function.
GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) ...
5.9 Medium
CVSS3